Workspace security center

1. 1

   Go to Settings, then Security, then Security center in your Lovable workspace.

   This is where you access the central dashboard to view all your projects' security statuses.

2. 2

   Review the 'Security insights' tab to see which projects need your attention most, based on things like security issues, who owns them, and if they are published.

   This helps you prioritize which projects to focus on first, especially those that are public or have critical issues.

3. 3

   Check the 'Code analysis' tab to see security findings from scans across all projects, including errors, warnings, and when they were last scanned.

   This gives you a quick overview of code-related security health and helps identify projects with outdated scans or critical issues.

4. 4

   Use the 'Supply chain security' tab to find out if any projects are using software components with known vulnerabilities.

   This helps you identify and address risks from third-party code that your projects rely on.

5. 5

   Look at the 'Secrets overview' tab to see all the secret names (like API keys) used across your projects, but not their actual values.

   This helps you keep track of what secrets exist and which projects use them, useful for auditing or rotating keys.

6. 6

   If you are on an Enterprise plan, go to 'Schedule security scans' to set up automatic 'Deep security scans' for your projects.

   This ensures your projects are regularly checked for security issues without you having to manually start each scan.

7. 7

   To fix an issue, click the 'View' option next to a project in any tab to go directly to that project's security details.

   This allows you to take action, like running a new scan, updating dependencies, or resolving findings within the specific project.

8. 8

   If you need a record, use the 'Export' dropdown on any tab that supports it to download security data as a CSV file.

   This provides a snapshot of your security status for audits, reports, or further analysis.

Lovable, show me the security status across all my projects. I want to see which projects have critical errors, outdated scans, or vulnerable dependencies. Also, list all the secret names used across my workspace. If any projects are published externally, highlight those first. I need to ensure everything is secure before our next release.

Workspace

Your main account area in Lovable where all your projects are organized.

Security findings

Any potential security problems or issues detected in your projects, categorized as errors, warnings, or info.

Scan coverage

How many of your projects have been checked for security issues, and how recently.

Scheduled scans

Automatic security checks that run regularly on your projects without you having to start them manually.

Secrets

Sensitive pieces of information, like API keys or passwords, that your projects use to connect to other services.

Dependency risks

Security problems that come from using external software components (dependencies) in your projects that might have known vulnerabilities.

PII

Personally Identifiable Information, which is any data that could be used to identify a specific person (like names, addresses, or social security numbers).

Auth providers

Services that handle how users log into your project, such as Google, Apple, or email/password systems.

CVE

Common Vulnerabilities and Exposures, which is a list of publicly disclosed cybersecurity vulnerabilities.

Deep security scan

A thorough security check that looks for a wide range of issues in your project's code and dependencies.

Credits

A unit of usage that Lovable charges for certain advanced features, like scheduled security scans.

• Assuming the Security Center automatically runs scans; you need to manually trigger scans or set up a schedule (Enterprise only).
• Expecting to see historical security data; it only shows the latest scan results.
• Trying to view or export actual secret values; only secret names are shown, not the values themselves.
• Believing security findings on a secret row apply to the secret itself; they apply to the project that holds the secret.
• Not checking projects marked as 'never scanned'; these projects have not had any security review yet.
• Ignoring warnings or info findings; while not critical errors, they provide important context and potential risks.