From the checkup catalog
Security checks for an app built in Lovable
What to look for after you publish a Lovable project: keys in the bundle, open tables, and a real browser pass.
Lovable can produce a working app in an afternoon. The public site then contains the built JavaScript, and that file is world-readable. A key that was convenient in the editor becomes a key anyone can copy.
A ShipCheck preview loads the published URL, reads the scripts, and looks for OpenAI, Anthropic, Stripe secret, Supabase service role, and similar patterns. It also tries the anon key against common tables and opens the page in a browser to catch console errors.
Paste the fix pack back into Lovable. The prompts tell it to move secrets to server environment variables and to turn on RLS. Verify the domain before the checkup will show which file held the key.
Publish again, then run the deploy hook so the next grade lands without you remembering to click.