Security overview

1. 1

   Understand that Lovable runs basic security checks automatically when you're about to publish your app.

   This helps catch common issues like database access problems or outdated components before your app goes live.

2. 2

   Manually run a 'Deep scan' from your project's Security view or the Workspace Security center, especially after big changes or before a major release.

   The Deep scan does a more thorough check of your code for hidden vulnerabilities, exposed secrets, and access control issues.

3. 3

   Review and fix any security findings in your project's Security view.

   This is where you see what Lovable found, understand why it's an issue, and get suggestions on how to fix it, sometimes even automatically.

4. 4

   Ask Lovable directly in the chat to review your app's security or a specific part of it, like your authentication.

   This uses AI to give you a detailed, conversational assessment and recommendations beyond the automated scans.

5. 5

   If your app handles sensitive data, consider connecting optional security tools like Wiz for advanced code scanning or Aikido for AI-powered penetration testing.

   These tools offer deeper analysis and can simulate real attacks to find vulnerabilities that built-in scanners might miss.

6. 6

   Ensure API keys and other secrets are stored in Lovable's 'Secrets' feature, not directly in your code.

   This prevents sensitive information from being exposed in your app's public-facing code, which is a major security risk.

Review my app's security and tell me if there are any critical issues I need to fix before publishing.

RLS policy linting

Checking your 'Row-Level Security' rules, which decide who can see or change specific pieces of data in your database, to make sure they don't have common mistakes that could expose information.

Dependency audit

Checking all the pre-built software components (like building blocks) your app uses to see if any of them have known security weaknesses.

Agentic review

An advanced analysis where an intelligent system (like an AI assistant) thoroughly examines your code and settings, thinking like a security expert to find problems.

Static analysis

Examining your app's code and settings without actually running the app, looking for risky patterns or known vulnerabilities.

Dynamic analysis

Testing your running app by interacting with it, sending different inputs, and trying to find weaknesses, similar to how a real attacker might.

Penetration testing (pentest)

A simulated cyberattack against your app to find security vulnerabilities that an actual attacker could exploit. AI pentesting uses AI to perform these tests.

SQL injection

A type of attack where malicious code is inserted into data inputs to trick a database into revealing or changing information it shouldn't.

XSS (Cross-Site Scripting)

A type of attack where malicious code is injected into a website, often through user input, and then executed in other users' web browsers, potentially stealing their information.

EPSS score

A number that estimates how likely a known security weakness is to be exploited by attackers in the real world.

• Assuming built-in scans guarantee complete security, especially for apps handling sensitive data or critical functions.
• Ignoring critical security findings before publishing your app, which can lead to data breaches or unauthorized access.
• Storing API keys or other sensitive information directly in your frontend code, making them easily discoverable by attackers.
• Not regularly reviewing Row-Level Security (RLS) policies, which can lead to users seeing or changing data they shouldn't.
• Neglecting to update third-party components (dependencies), leaving your app vulnerable to newly discovered weaknesses.
• Relying only on automated scans and not performing conversational security reviews or optional advanced testing for deeper insights.