PRE-DEPLOY CHECKLIST · LOVABLE
Security Check Before Deploying Your Lovable App
You built it fast. Lovable wrote most of the code. Now you're about to hit deploy — and you have no idea if there's a leaked API key sitting in your frontend bundle.
Why AI-generated apps ship with security gaps
Lovable, Bolt, Replit, v0, and Cursor optimise for “it runs.” They don't ask “should this database table be publicly readable?” or “is this environment variable now visible in the client bundle?” Those questions are on you — and most solo builders skip them because they don't know where to look.
In a study of 100 publicly-deployed AI-built apps, 31 leaked something they shouldn't — credentials, internal data, or unauthenticated endpoints. Most founders had no idea.
The 10-point pre-deploy security check
API keys in the frontend
Search your built bundle for `sk_`, `AIza`, or any secret prefix. If it's in client-side JS, it's public. Any key that calls a paid API or touches user data must live server-side.
Database rules
Is your Supabase or Firebase table open to anonymous read/write? Check the actual Row Level Security policies — not just the dashboard toggle. A table with RLS disabled is readable by anyone who finds your project URL.
How to find and fix Supabase RLS disabled →Auth on every route
Lovable may have added a login page without gating the API routes behind it. An unauthenticated `GET /api/users` returns everyone's data regardless of whether your frontend shows a login screen.
CORS wide open
`Access-Control-Allow-Origin: *` on anything that touches user data is a red flag. Restrict it to your own domain in production.
.env committed to git
Run `git log -p .env` — if your secrets ever touched git history, they're exposed even if you deleted the file. Rotate any key that appears.
How NEXT_PUBLIC_ env vars expose secrets in Next.js apps →Admin routes guessable
`/admin`, `/dashboard`, `/internal` with no auth check. Even if they're not linked from the frontend, anyone can guess them.
Third-party webhook secrets
Stripe, Clerk, Resend — are signing secrets verified server-side? An unverified webhook endpoint lets anyone trigger your payment logic by sending a fake payload.
File upload validation
Can a user upload a `.php` or `.exe` disguised as an image? Validate MIME type server-side (not just the extension) and never serve uploaded files from the same origin as your app.
Rate limiting on auth endpoints
Login and signup with no throttling invites credential stuffing. Add a simple rate limit — even 10 requests per minute per IP is enough to block automated attacks.
Error messages leaking stack traces
Production errors should never show file paths, query text, or stack traces to the client. Log internally, return a generic error string.
THE FAST WAY
Run all 10 checks automatically in under two minutes
Going through all 10 by hand takes an afternoon if you know what you're doing, and a guess-and-pray session if you don't. vibecheck clones your repo, runs Gitleaks, Semgrep, njsscan, and 50 custom checks, then Claude explains every finding in plain English with a concrete fix — not CVE jargon.
Run a free pre-deploy security scan →FAQ
Do I need to do this if Lovable already has "security" features?
Those platforms sandbox the build environment — they don't audit your app's runtime logic. The checklist covers what they don't: your database rules, API route auth, secrets in git history, and webhook signature verification.
How long does a manual check take?
30–60 minutes if you know what you're looking for. Many of these checks require shell access, reading your git log, and understanding your database's permission model. vibecheck automates the whole scan in under two minutes.
Does this apply to Bolt, v0, Replit, and Cursor apps too?
Yes. The same gaps appear across all AI-assisted code generators because the underlying issue is that LLMs optimise for functionality. The checklist items — RLS, env secrets, unauth routes — show up regardless of which tool generated the code.
RELATED GUIDES