ShipLatch

Frequently looked up

Q1Is my Lovable app secure?

Security depends mostly on your Supabase setup and Row Level Security configuration. Lovable apps typically ship the Supabase anon key in the browser, which is normal and safe if RLS is enabled on every table with correct policies. Common problems include RLS being turned off, overly permissive policies, service_role keys leaking into frontend code, and secret API keys in client code. ShipLatch's free scan checks the public side for leaked keys, exposed files and headers; the paid deep scan tests your RLS after you verify ownership.

Q2Is the Supabase anon key safe to expose?

Yes, the anon (or publishable) key is designed to be public and will always be visible in your frontend. It is only safe if Row Level Security is enabled on every table and your policies are correct, because anyone can use that key to query your database directly. The service_role key is different: it bypasses RLS and must never appear in client code. If it does, rotate it immediately in the Supabase dashboard.

Q3What does the free ShipLatch scan check?

The free scan loads your public page and up to 20 scripts it references, plus up to 3 public source maps and one request each to files that should never be public like /.env, /.git/HEAD and supabase/config.toml. It looks for leaked secrets from OpenAI, Anthropic, Stripe, AWS, GitHub, Supabase and more, exposed files, missing security headers, source maps, and whether you use Supabase or Firebase. The scan is passive and read-only with no logins, form submissions, or attack attempts.

Q4What do the Fix Pack and Stay Locked add?

Both unlock copy-paste fix prompts for every finding and the ownership-verified deep scan, which includes a read-only Supabase RLS probe that requests zero rows and reads only row counts, plus Firebase security rules checks. The Fix Pack ($29 one-time) includes one deep scan and 2 re-scans for one app. Stay Locked ($15/month) includes unlimited re-scans of one app, an independent scan on every deploy with grade drop alerts, a deploy hook URL for Vercel, Netlify or GitHub Actions, and an automatic daily re-scan.

Q5How do I check my app for leaked API keys?

Open your live site, view the page source and the JavaScript bundles it loads (browser dev tools, Sources tab), and search for key prefixes like sk-, sk_live_, AKIA, ghp_, service_role or sb_secret_. Also try opening /.env and /.git/HEAD on your domain. ShipLatch's free scan does exactly this automatically for the page and up to 20 scripts. If you find a secret key, rotate it with the provider; deleting it from the code is not enough once it has been public.