Is Lovable secure?

Lovable is a solid platform. The security gaps in a shipped Lovable app almost never come from the platform itself — they come from AI-generated code that skips the boring parts: Row Level Security policies, CORS scopes, and secret handling. This guide walks through the checks we see fail most often in AI-built apps and how to fix them.

1. Keys in the client bundle

AI often inlines API keys directly in components. Anything the browser can read is public. Move secrets to server functions or edge functions, and only expose the publishable/anon key on the client.

2. Missing RLS policies

Every table under the public schema needs Row Level Security enabled and policies that scope reads and writes to the calling user. A table with RLS enabled but no policies denies everything; a table without RLS is world-readable through the Data API.

3. Open CORS + missing headers

Access-Control-Allow-Origin: * combined with credentialed fetches is a common AI-generated footgun. Lock CORS to your own origins, and ship a baseline of security headers: CSP, X-Content-Type-Options, Referrer Policy, and Strict-Transport-Security.

4. Auth holes on server functions

Server functions that read user data must verify the caller. On TanStack Start apps, that's the auth middleware — without it, any anonymous caller can hit the endpoint.

5. Exposed .env, .git, source maps

Static hosts sometimes serve /.env or /.git/config by accident, and source maps ship API URLs and secrets straight to the browser. Confirm these return 404 in production and strip source maps from the published build.