Lovable security audit
A security audit for Lovable apps on Supabase
This is for founders whose app was built in Lovable and now has real users, payments or personal data, on Lovable Cloud or a Supabase project they own. In two weeks we review the app's code and its backend, rank every risk with the effort to fix it, and walk your team through a 90-day plan. It's our code audit, with the same fixed price, from $5,000, agreed in writing before we start. It isn't a penetration test.
The review is done by Sachin Mour, who leads engineering at Pulore. He led Emblem's platform as CTO, moved Hexis off hosted Supabase to its own Google Cloud setup, and wrote our security checklist for Lovable apps. You can read a sample report before you book.
Why Lovable's scan isn't the whole answer
Lovable scans your app for you. The Quick scan runs every time you publish, and the Deep scan, which reads all of your code, runs when someone starts it. Lovable's docs say these tools find common issues but can't guarantee complete security, and suggest a professional review for apps that handle sensitive data.
Many of the gaps that matter in a Lovable app are rules only you can judge: whether a policy lets one customer read another's invoices, or a function trusts an ID the browser sent. A scanner can see that a table has a policy, but not whom each row belongs to. The German security firm Crissy Field found 24,664 of 34,545 Lovable apps on Supabase sending database records to visitors who weren't signed in (report). Some of that data is meant to be public, and our checklist covers what the figures do and don't show.
Lovable's docs were checked on November 11, 2026.
What we check in a Lovable app
We start with the paths that carry sign-ins, payments and customer data, and follow each one from the browser to the database.
Database rules
Row level security on every table the API can reach, and whether each policy checks who owns the row, not just that someone signed in.
Keys
Which keys ship to the browser, whether a secret key ever reached the bundle or the repository, and what each key can do.
Storage
Whether buckets are private, and whether one user can list or download another user's files.
Functions and server routes
Edge functions and server functions that skip the sign-in check, trust IDs from the browser, or use the service role key, which bypasses every policy.
Auth settings
Email confirmation, leaked-password protection, exact redirect URLs and rate limits, set for real traffic before launch.
Payments and backups
How payment webhooks are verified, whether the browser can change what someone pays, and whether anyone has restored a backup.
Then the rest of a code audit: the architecture, tests, data model, deploys and running cost, so you also know what breaks first as usage grows.
Lovable Cloud or your own Supabase project
Both work. On Lovable Cloud, Lovable runs Supabase's open-source stack for you and you manage it inside Lovable. On your own project, you manage it in Supabase's dashboard. Either way the same Postgres policies decide who can read and change each row, so we check them the same way.
We need read-only access to the code and the database settings. On Lovable Cloud, you invite our Lovable account to the project as a viewer from the Share menu: Lovable's viewers can open a project, but can't edit it, publish it or change its settings. For your own Supabase project, or anything a viewer can't see, we agree on the kickoff call how you share it. We don't change anything in your project, and you can keep building in Lovable while we work.
See a sample report
Our sample report is the report this audit delivers, written for Acme, a demo client portal we built with React, Vite and Supabase in the layout Lovable generates. It has 21 ranked findings with evidence, fixes and hours, and a 90-day plan. To show the findings were real, we reproduced 16 attacks on a local copy: each was refused after the fixes and worked again when we reverted them.
Acme is a demo app we built ourselves, with made-up data. It wasn't built in Lovable, so Lovable's scans didn't run on it.
How the two weeks run
Kickoff and access
A call with you and whoever built the app. You invite our Lovable account to the project as a viewer, or share read-only access to your Supabase project, and tell us which data matters most.
Week one: follow the data
We trace sign-in, payments and customer data from the browser to the database, read every policy and function on the way, and run each check on our list.
Week two: rank and write
Each finding gets evidence, an effort estimate and a priority: fix now, fix this quarter or leave alone. Then we write the 90-day plan.
Walkthrough
A 60-minute call to go through the report with you and your developer, and a fixed quote for the top fixes if you want us to do them.
Price, and who it's for
It's a fixed price from $5,000 for one app, its backend and one cloud account, agreed in writing before we start. Several services, regulated data or a bigger team usually brings it to $8,000 to $12,000. If you book fixes or fractional CTO time with us within 60 days, the fee counts toward them.
That's more than an automated scan, and it's meant for apps where a mistake costs more than the audit: real users, payments, personal or health data, a raise coming up, or an enterprise customer's security questionnaire. If you're still prototyping, start with Lovable's free Deep scan and our checklist.
A good fit
- A Lovable app with real users, payments or personal data.
- A launch, a raise or an enterprise deal in the next few months.
- A founder or developer who will act on the findings.
Not the right fit
- You need a penetration test or a compliance audit. For SOC 2 or HIPAA readiness, see HIPAA and SOC 2 engineering.
- You're an investor checking a company before you invest. That's technical due diligence.
- A prototype with no users yet. The free checklist and Lovable's Deep scan are the right first step.
What you get
Ranked findings
Each risk with evidence from your code or settings and the effort to fix it, sorted into fix now, fix this quarter and leave alone.
The fix for each finding
The SQL for a policy, the setting to change or the code to rewrite. On Lovable Cloud, you can paste the SQL into the project chat so Lovable applies it as a migration.
A 90-day plan
The order to fix things in, so you or your developer can start the following week.
A one-page summary
What matters most and what it costs to fix, written for founders and investors.
A walkthrough call
60 minutes with you and your developer to go through the findings and the plan.
A quote for the fixes
A fixed price for the top fixes, if you want us to do them. The audit fee counts toward fixes booked within 60 days.
What we've done for clients
Hexis
Rebuilding the platform behind elite sports nutrition
Sachin moved Hexis off hosted Supabase to its own Google Cloud setup, defined entirely in Pulumi, with PostgreSQL replicated across regions.
Read the Hexis case studyEmblem
AI due diligence that cites its sources
Sachin led Emblem's platform as CTO, including the Google Cloud infrastructure and the security work behind its SOC 2 program. Emblem has completed SOC 2 Type II.
Read the Emblem case studyHow a project starts
From a free call to the end of the second week.
A free 30-minute call
Tell us what the app does, whether it's on Lovable Cloud or your own Supabase project, and what data it holds. We'll tell you whether an audit is the right step, or whether the free checklist is enough for now.
A fixed price, or hourly
After the call we send a fixed-price quote for a clear scope, or agree on hourly work at $100 to $150 an hour. The audit is a fixed price from $5,000 for one app, and usually $8,000 to $12,000 for bigger systems. If you book fixes or fractional CTO time within 60 days, the fee counts toward them.
The first two weeks
- A kickoff call, then read-only access to the code and the project's database settings.
- We trace sign-in, payments and customer data through the app and run each check on our list.
- At the end of week two, you get the report, the 90-day plan and a 60-minute walkthrough.
Frequently asked questions
Is a Lovable security audit a penetration test?
No. We review the code and the project's settings: database policies, keys, storage, functions and auth. In a penetration test, security testers attack the running app to find a way in. If you need one, or a compliance audit, we'll say so on the first call.
Isn't Lovable's built-in security scan enough?
It's a good start, and it's free. Lovable's docs say the scans find common issues but can't guarantee complete security, and suggest a professional review for apps with sensitive data. A scan can see that a table has a policy. It can't tell whether that policy lets one customer read another's records, which is where we spend most of the two weeks.
Is Lovable secure?
Lovable has its own security team and scans every app when you publish it. What it can't decide for you are your app's rules: which tables need row level security, whether a policy checks who owns a row as well as who's signed in, and which keys may reach the browser. Our security checklist for Lovable apps shows how to check each one.
Do you audit apps on Lovable Cloud, or only Supabase projects I own?
Both. Lovable Cloud runs Supabase's open-source stack, managed by Lovable, so the same database policies protect your data either way.
What access do you need?
Read-only access to the code and the database settings. On Lovable Cloud, invite our Lovable account to the project as a viewer from the Share menu. Viewers can't edit, publish or change settings. For your own Supabase project, we agree on the kickoff call how you share access. We don't change anything in your project, and you can keep building in Lovable while we work.
Will you fix what you find?
If you want us to. The walkthrough comes with a fixed quote for the top fixes, and if you book them within 60 days, the audit fee counts toward them. Or apply them yourself: each finding comes with its fix, and on Lovable Cloud you can paste the SQL into the project chat.
How much does a Lovable security audit cost?
From $5,000 for one app over two weeks, at a fixed price agreed before we start. Several services, regulated data or a bigger team usually comes to $8,000 to $12,000.
Do you audit Bolt or Cursor apps too?
Yes. Our code audit covers apps built with Bolt, Cursor or by hand, at the same price. This page covers what's specific to Lovable.