Pre-launch security check for a Lovable or Supabase app

What it does

Lovable runs a Quick scan on every publish (database access rules, npm dependencies, unauthenticated MCP servers) and offers a Deep scan of your app code for access control, abusable endpoints, injection, leaked secrets, payments and auth. Supabase's Security Advisor runs deterministic checks such as tables in the public schema without row-level security, always-true policies like USING (true), views that bypass RLS and policies that trust user-editable metadata.

How builders use it

• In Lovable, open the Security view and run the Deep scan before publishing; fix Critical findings first.
• In Supabase, open Security Advisor in Studio, or run supabase db advisors from the CLI, and clear every ERROR-level finding.
• Replace placeholder USING (true) policies with owner checks like (select auth.uid()) = user_id.
• Move any API key out of frontend code into Secrets and a server-side function.
• Turn on leaked-password protection if you use email and password sign-in.

What to expect

You publish knowing no table is open to the internet and no secret ships in the browser bundle. Both vendors say these checks don't replace a professional review for sensitive apps.

Review my app's security before I publish.
1. List every database table, whether row-level security is enabled, and the policy on each one. Flag any policy that is always true or that relies on user_metadata.
2. Find any API key or secret in frontend code and move it to a server-side function using stored secrets.
3. List every endpoint or function that can be called without signing in and explain whether that is intended.
4. Check that users can only read and change their own records.
Show me the findings first; don't change anything until I confirm.