ScanYourSite

Is your Lovable app ready for real users?

Lovable apps are React plus Supabase, and most of their problems live in the gap between the two: what ends up in the browser bundle and what the database lets anyone read. Paste your Lovable or custom-domain URL and see what to fix before you share the link.

Free, no sign-up. The basic check makes only the requests an ordinary browser would.

See a full example report

What we check on a Lovable app

Check it yourself in ten minutes

You don’t need us to find the worst of it. Here is how to check a Lovable app by hand — and what each result means.

  1. Look at the Supabase key in your code

    Open the generated Supabase client file (usually src/integrations/supabase/client.ts) and search the whole project for service_role and sb_secret_. Only the anon or publishable key belongs in the app.

    service_role
sb_secret_

  2. Decode the key the live site actually ships

    Open your live site, then DevTools → Console. Paste the key you see in the Network tab (the apikey header of any request to supabase.co) and decode it. "role": "anon" is fine; "service_role" means rotate it now.

    JSON.parse(atob("<the key>".split(".")[1])).role

  3. Run Supabase’s Security Advisor

    Supabase dashboard → Advisors → Security Advisor. Every table listed as having Row Level Security disabled can be read by anyone with the anon key.

  4. Check what a link preview shows

    Open view-source: in front of your URL. If the <title> is still the template’s and there is no meta description, search engines and chat apps see that too. Edit index.html.

    view-source:https://your-app.lovable.app

Paste the fix straight into Lovable

Each report ends with a prompt written for an AI builder: what is wrong, in which file, and how to check that the fix worked. Paste it into Lovable chat.

Fix these issues on myapp.lovable.app. Locate each one before changing anything.

1. A Supabase service_role key is in assets/index-8a1d.js.
   Move the queries that need it into a Supabase Edge Function, rotate the key in the Supabase dashboard and keep only the anon key in the app.

2. The page has no meta description after render.
   Add a description and Open Graph tags in index.html.

When done, re-check: https://scanyoursite.app/en?check=myapp.lovable.app

Every Lovable edit is a deploy

One prompt can rewrite half the app. With Pro we notice each new version, check it within minutes — is the site up, did a key leak back into the bundle — and write only when something new is wrong.

See plans

Questions

Does it work on a lovable.app subdomain?

Yes, and on a custom domain. Advanced checks such as the table check need proof that the domain is yours, which you can only give on a domain you control.

Will the table check change my data?

No. It sends one HEAD request per table with your public anon key to count readable rows. It never reads row contents and never writes.

Is the anon key in my bundle a problem?

No, it is designed to be public. The danger is the service_role or secret key, or tables without Row Level Security — that is what we look for.

For vibe coders

Paste your URL. Get the list in about a minute.

Every finding comes with what it means for you and how to fix it — or a prompt your AI coding tool can apply.

Free, no sign-up. The basic check makes only the requests an ordinary browser would.