What should I read before a VibeCheck scan?
Read the Lovable, Supabase row level security, and leaked API key guides, then scan an origin you prove you own.
Is my Lovable app secure?
A Lovable app is secure only when the database rules, server-side auth, and client bundle match what the UI shows; a working preview does not check those.
Is row level security on for my Supabase tables?
Row level security is on only when every table the client can reach has RLS enabled and a policy that limits rows to the people who should see them; the anon key still ships in the browser.
Did my vibe-coded app leak an API key?
An API key is leaked when it appears in JavaScript the browser downloads, in a public file such as .env, or in a variable prefixed with NEXT_PUBLIC_ or VITE_.