Check what your Lovable app exposes
Lovable ships fast. VibeSitter checks the public surface of your app, then shows the exact setting, header, or Supabase policy to fix — in plain English and as a prompt you can paste back into Lovable.
What you get
- ✓Instant A–F grade from a public URL — no signup.
- ✓Plain-English evidence for every issue.
- ✓Copy-paste SQL/config fixes and an AI-tool prompt.
- ✓Read-only Supabase connection for database-level checks.
Checks that matter here
Exposed environment variables
Detects service-role keys or private tokens accidentally shipped in the browser bundle.
Missing security headers
Checks clickjacking, MIME sniffing, referrer policy, and transport protections.
Supabase RLS gaps
Connected scans check whether public tables are protected by row level security.
CORS and auth settings
Flags permissive cross-origin rules and Supabase auth settings that weaken account safety.
Run a free check
Public URL only. No keys, no signup, no credit card.
Want database-level checks? See exactly what we access.
Common questions
Do you need my Lovable account?
No. A free scan only needs your public app URL. Database checks use a read-only Supabase OAuth connection.
Is this a penetration test?
No. VibeSitter checks public metadata and configuration. It does not send payloads, scan PII, or certify compliance.