Library
Docs
Security overview
The short version
Lovable helps protect your apps by automatically scanning for security issues during development and before publishing. It offers built-in scans, optional integrations, and tools to help you fix findings and ensure your app is secure.
Anyone building an app with Lovable needs this to understand how to keep their project secure from common vulnerabilities.
Words decoded
- API key
- A secret code that acts like a password, allowing your app to access services from another company.
- Database access rules
- Settings that control who can see, change, or delete information stored in your app's database.
- Dependency audit
- A check of all the pre-made code packages your app uses to see if any have known security problems.
- MCP server
- A specific type of server in Lovable that handles certain app functions; it needs to be protected from unauthorized access.
- Row-level security (RLS)
- A feature that lets you set very specific rules about which individual pieces of data a user can see or change in your database, based on who they are.
- Static analysis
- A security check that looks at your app's code and settings without actually running the app, searching for risky patterns.
- Dynamic analysis
- A security check that runs your app and interacts with it like a real user or attacker would, to find vulnerabilities that only appear when the app is active.
- Penetration testing (Pentest)
- A simulated cyberattack against your app to find security weaknesses before real attackers do.
- Software composition analysis (SCA)
- A process to identify and evaluate the open-source and third-party components used in a software application to detect known security vulnerabilities.
- Static application security testing (SAST)
- A type of security testing that analyzes an application's source code, bytecode, or binary code for security vulnerabilities without executing the application.
- EPSS score
- A number that estimates how likely a known security flaw is to be actively used by attackers, helping you decide which flaws to fix first.
- XSS risks
- A type of security flaw where malicious code can be injected into a website, often through user input, and then executed by other users' browsers.
Where people get stuck
- Relying solely on Lovable's built-in scans for apps handling sensitive data or critical functions, as they don't replace a full professional security review.
- Hardcoding API keys or other secrets directly into your app's frontend code, which can expose them to unauthorized access.
- Not regularly reviewing your database access rules (RLS policies), especially after changes to authentication or database structure, which can lead to data leaks.
- Ignoring dependency audit findings, as third-party libraries can introduce significant security risks.
- Failing to run Deep scans regularly, as they cover application-specific logic and permissions that Quick scans miss.
- Publishing an app with critical security issues if your workspace settings allow it, potentially deploying an insecure application.
- Not keeping dependencies up to date, which can leave your app vulnerable to newly discovered security flaws.
The short version, steps, decoder and prompt on this page are written automatically from Lovable's own documentation and can lag or misread it. The official page is always the authority.