Is my Lovable app secure?
A Lovable app is secure only when the database rules, server-side auth, and client bundle match what the UI shows; a working preview does not check those.
What should I verify before launch?
Verify data access, secrets in the client, admin routes, and paywalls on the origin you own before you treat a Lovable preview as ready.
VibeCheck can run that review after you publish a DNS TXT record or a well-known file and check the consent box.
Can the public Supabase key read my tables?
The anon key in the browser is public by design, so a table with row level security off, or a policy that allows the anon role, is readable by anyone who loads the app.
Turn on row level security and add a policy that limits rows to the signed-in user before you ship.
What if the app uses Firebase?
Firebase client config is public, and the project returns data to strangers when the rules allow a read with no signed-in user.
Start from deny-all rules, then open a path only to the signed-in user who owns that record.
{
"rules": {
".read": false,
".write": false,
"users": {
"$uid": {
".read": "auth != null && auth.uid === $uid",
".write": "auth != null && auth.uid === $uid"
}
}
}
}Are secrets sitting in the generated client?
A service-role key, secret API key, or private token in the JavaScript bundle is already exposed, because the browser downloads that file.
Remove it, rotate it, and keep the replacement in a server-only variable that is not prefixed with NEXT_PUBLIC_ or VITE_.
Does hiding an admin link protect the route?
Hiding a link does not protect an admin page or API that still returns data when no session cookie is sent.
The route has to check the session on the server and return 401 or 403 when the cookie is missing.
Can a visitor skip a paywall in the browser?
A premium flag that lives only in client state can be changed in the browser, and a payment webhook that does not check a signature can be called by anyone.
Enforce the purchase on the server, and verify the webhook signature before granting access.
What will a VibeCheck report not promise?
A finished report is a point-in-time list of findings and fixes for the origin you scanned. VibeCheck scans origins you prove you own. Reports are a point-in-time look at findings and fixes, not a certification.