Is your Lovable app secure? Here is how to check
Lovable apps usually talk to Supabase from the browser, which is fine when row-level security is set up and dangerous when it is not. SixthWall scans the code Lovable generated for leaked keys, missing checks and unsafe queries, and tells you what to change.
Three steps
- 01
Connect your Lovable project to GitHub
In Lovable, open the project settings and connect GitHub. Lovable pushes your code to a repository you own.
- 02
Clone the repository and run init
On your computer, clone the repo, open a terminal in the folder, and run the scanner. Node.js 18 or newer is required.
npx @sixthwall/cli init - 03
Fix in Lovable or in the code
Each finding includes a plain-English prompt. Paste it into Lovable's chat, or into any AI editor, to apply the fix. Lovable syncs the change back.
What it looks for
The same rules run for every project, whatever tool wrote the code. These are the most serious ones. See all rules.
Questions
Does SixthWall check my Supabase row-level security policies?
Not yet. Rules for open RLS policies and service-role keys used in the browser are next on the roadmap because they are the most common serious mistake in Lovable projects.
Does my code leave my machine?
No. The scanner runs locally, makes no network calls during a scan and needs no account. The only download is the scanner itself.
Is it free?
Yes. The editor scanner, the Claude Code integration, the pre-commit hook and the GitHub Action are free with no limits.