Prodable’s free scanner runs about 48 look-only checks on your live Lovable app — can strangers read or change your data, are secret keys (Supabase, Stripe) leaking, are your back doors left open. No signup, results in about a minute. Most Lovable apps we test have data anyone can read; see exactly where yours stands.
Paste your Lovable subdomain or custom domain — the scan works on any live URL.
CVE-2025-48757 was a Lovable Row-Level-Security misconfiguration that exposed 303 endpoints across 170 projects. The pattern is specific to how these apps are built: the frontend talks straight to Supabase with the anon key, so the only thing standing between the public and your tables is whether RLS is actually locked down — and by default, on a lot of generated apps, it isn’t.
Supabase does the right things here: it ships RLS-on-by-default and a Security Advisor. But those tools check that a policy exists, not that the lock actually blocks the read or the write. Prodable does the opposite — it performs a real anonymous read, and a guarded empty-body write, against your live tables and reports only what actually returned data or succeeded. That’s the difference between “a policy is configured” and “anyone on the internet can select your users table right now.”
Lovable has taken security seriously too — it shipped native security scans in April 2025 and an Aikido pentest partnership ($100/test) in March 2026. Those are genuinely useful. But a platform can’t be the independent auditor of itself. When you need to tell a customer “this is safe,” the verification should come from a layer that doesn’t also ship the code.
We don’t check whether a lock exists — we test whether it actually locks. Prodable is the independent layer above Lovable, not the Lovable security tool.
Can the public read or change your data
We actually try to read your data — and make a safe, empty test write — as an anonymous stranger, then report only what really came back or went through. No guessing from settings.
Leaked keys and passwords
We read the code your app ships to the browser, rebuild any hidden code left exposed, and hunt down master keys that unlock your whole database — plus leaked Stripe, OpenAI or Supabase keys, password files, and hidden project files.
Doors left open to the internet
We knock on the hidden addresses your app uses to find the ones that skip the login check, let other websites act as your logged-in users, or are missing basic browser protections.
We run about 48 safe, look-only checks on your live site and give you a grade from A+ to F. We only read what's already public — we never log in, change, or delete anything.
The only honest answer is to test the live app. Because Lovable apps talk straight to Supabase, the most common exposure is Row-Level Security that was never fully locked down — CVE-2025-48757 exposed 303 endpoints across 170 projects this way, and an estimated 70% of Lovable apps fail an anonymous-read RLS check. Prodable's free scan performs a real read/write probe against your tables and tells you which, if any, are open right now.
First confirm which tables are actually readable or writable by the public — an RLS policy can exist and still not block access. Prodable's scan shows you the specific tables that returned data, then the fix is to add or tighten policies in Supabase so anonymous requests are denied. Re-scan afterwards to verify the lock now holds.
Lovable shipped native security scans in April 2025 and an Aikido pentest partnership ($100/test) in March 2026, and both are genuinely useful. But a platform can't be the independent auditor of itself. Prodable runs the check from the outside, with no access to your project, so the result is independent verification you can show a customer.
No. The scan is strictly non-destructive: read-only probes of your public URL. The only 'active' check is a guarded empty-body insert used to distinguish a real writable table from a schema error — it never writes real data, authenticates, or attempts anything destructive.
Free, no signup, results in about a minute. You see your full grade with no email — the scan is free because fixing what it finds is where we come in.