Scan your Lovable site before you ship
Lovable generates React + Vite front ends, usually wired to Supabase. It gets you to a working app fast, but the generated client code and default hosting leave a few launch gaps worth checking.
Free · No signup · Only scan sites you own or have permission to test
Common Lovable launch issues
🛡️ Security
- API keys for OpenAI or other services pasted into prompts can end up in the client bundle instead of a Supabase Edge Function.
- The Supabase anon key is meant to be public, but only if Row Level Security is on for every table; a service_role key in the browser bypasses RLS entirely.
- Security headers like Content-Security-Policy and X-Frame-Options usually aren't set unless you add them on your host.
🔎 SEO
- Apps are client-rendered single-page apps, so the raw HTML is often nearly empty for crawlers and link-preview bots that don't run JavaScript.
- Every route can share the same <title>, description and Open Graph tags unless you set them per page.
- robots.txt and sitemap.xml may be missing or generic.
⚡ Performance
- All routes often ship in one large JavaScript bundle, which slows the first load on phones.
What ChillScan checks on your Lovable site
- ✓ Leaked OpenAI, Stripe, AWS and other keys in your JS bundles
- ✓ Supabase service_role JWTs and sb_secret_ keys
- ✓ Security headers and HTTPS
- ✓ Blank-without-JavaScript pages, titles, meta and Open Graph tags
- ✓ JavaScript bundle weight
ChillScan reads only what a visitor's browser receives. It doesn't run JavaScript and can't scan pages behind a login or bot protection. See every check → · See a sample deep report →