People build web apps in AI app builders like Lovable, and some of those apps leak data. In October 2026 a scanner company checked 86 public Lovable apps: every one had at least 3 likely issues, and one exposed a live OpenAI key to any visitor. This is the scanner's own data, not checked by hand.
What the checker looks for
- Secret keys visible in the browser: OpenAI, Stripe, Supabase service_role.
- Customer data that a stranger can read without signing in.
- Missing security headers (CSP, HSTS).
The prompt
Open Claude Code, an AI coding tool, in an empty folder and paste this:
Build a security checker for a web app made with Lovable or a similar AI app builder. Given a link, the program: 1) downloads the page and its scripts and looks for secret keys (OpenAI, Stripe, Supabase service_role); 2) if the code has a Supabase URL and public key, checks read-only which tables return data without signing in; 3) checks the security headers (CSP, HSTS). Output: an HTML report in plain English: what was found, why it matters, how to fix it in Lovable and Supabase. Never change or write anything in someone else's database. Run it only on your own app or with the owner's written permission. Show me the plan first, then the code.
Rules
- Test only your own app, or with the app owner's written permission.
- Work on a copy, never on the live app.
- Never promise 100% security.
- A scan is cheap. Fixing what it finds takes a person.
Market prices
- Lovable's own automated security test: $100.
- Aibrify security check: $300.
- Pen test on Contra: from $497, one critical fix $120.
- Rapid Developers audit: $1,000.
Prices are vendors' public prices on Nov 9, 2026. They are not income figures.
Sources: aibrify.com/fix/lovable, vespez.com/research/lovable-100, shipsniffer.com, lovable.dev/blog/announcing-pentesting, contra.com, rapidevelopers.com/lovable-security-audit.
We are not affiliated with the companies mentioned.