Why Lovable apps leak secrets
Lovable builds full-stack apps quickly, and most of them lean on Supabase for the database and auth. That combination has one recurring danger: the difference between the Supabase anon key and the service_role key. The anon key is meant for the browser and is protected by row level security. The service_role key bypasses those rules entirely, and if it ends up in client code or a committed file, anyone can read and write your whole database.
Because the mistake lives in the source and configuration, a scan of the running site will not reliably catch it. ShipSafeScan reads the repository itself, so it can flag a service_role key sitting in a file that never renders in the browser but is fully readable in your public repo.
A quick scan gives you a score and a focused list, so you can confirm the right key is client-side, the powerful key is server-only, and no credentials were committed by accident. Re-scan after each fix to check it off.
Common Lovable security mistakes
service_role key in client code
The service_role key bypasses row level security. If it reaches the browser bundle or a committed file, treat it as fully compromised, rotate it, and keep it server-side only.
Row level security left off
If RLS is disabled, even the anon key can expose more data than intended. Turn RLS on and write policies for each table.
Supabase URL and keys committed to the repo
Connection strings and keys pasted into source stay in Git history. Move them to environment variables and rotate anything that was public.
Source scan vs live-site scan
Some checks only look at your deployed site. That view misses two things that matter for a Lovable project: files that never render in the browser, and your Git history. A secret can be gone from your live app and still sit in an old commit in a public repo. ShipSafeScan reads the repository source, so it can flag those cases and point you at the exact file and line.
Lovable security: frequently asked questions
How do I know if my Lovable app exposed a Supabase key?
Paste your public GitHub repository URL into ShipSafeScan. It scans the source for Supabase keys and other secrets, masks what it finds, and reports it. If the service_role key is flagged in client code, rotate it and keep it server-side only.
What is the difference between the Supabase anon and service_role key?
The anon key is meant for the browser and is limited by row level security. The service_role key bypasses those rules and must stay on the server. Exposing the service_role key can give anyone full access to your database.