Lovable · Security scan
Lovable turns a prompt into a full-stack React app with a Supabase backend already wired up — auth, database tables, and edge functions included by default.
8 security checks run automatically: secrets, CORS, headers, dependencies, config exposure, auth flaws, debug artifacts, and deployment readiness.
What we look at for Lovable
Wardloom always runs the full catalogue — these are the ones Lovable projects most often get wrong, based on how the tool tends to generate and deploy code.
We look for live API keys, tokens, and credentials sitting in client bundles or source where a stranger can copy them.
One leaked Stripe or OpenAI key can empty a wallet overnight. Catching secrets before launch is the cheapest security win for vibe-coded apps.
We review weak JWT secrets, missing rate limits, and insecure session patterns that show up in code and config.
Login is the front door. Soft session handling is how accounts get guessed, replayed, or shared without you noticing.
We look for server-only secrets used in the client, exposed dotfiles, and keys that belong behind the server wall.
AI scaffolds often put REACT_APP_ or NEXT_PUBLIC_ in front of secrets by habit. Config exposure is how private settings become public pages.
We scan your dependency tree for known-vulnerable or abandoned packages that still ship with the app.
Most vibe-coded stacks inherit risk from npm. Known CVEs are public; attackers do not need inventiveness, only an unpatched install.
Common Lovable mistakes
What a scan like this can't see
Wardloom is honest about its limits. Server-side authorization & auth logic is not something a read-only scan can verify from the outside — it requires a connected repo scan or a manual review. A clean result means nothing visible was wrong, not that everything was checked.
FAQ