Security sweep
For anyone who wants the three riskiest areas checked fast.
Who this is for
You have a working app and a nagging question: can someone see data they should not, or use a key they should not have? This package answers that question quickly and cheaply.
It is also the right first step after a user or a stranger emails you about a problem they noticed.
Built for founders who built with an app builder, and anyone about to take payments.
What we check
Three categories, the ones with the most named incidents in the evidence list.
Secrets and keys
API keys and passwords the app uses to talk to other services.
5 checks
Secrets and keys
API keys and passwords the app uses to talk to other services.
Data access
Rules that decide which user can read or change which rows in the database.
7 checks
Data access
Rules that decide which user can read or change which rows in the database.
- Firebase rules left in test modeCritical
- Record ids accepted without an ownership checkCritical
- Inverted policy logicCritical
- Any signed-in user can read every rowCritical
- Row Level Security disabled on a tableCritical
- RLS policy that allows everything with using (true)Critical
- Uploaded files in a public storage bucketHigh
Login and permissions
How the app knows who you are and what you are allowed to do.
7 checks
Login and permissions
How the app knows who you are and what you are allowed to do.
- Admin routes without any login checkCritical
- Authorization enforced only in the browserCritical
- Default admin credentials left in placeCritical
- Tokens trusted without server verificationCritical
- Role chosen by the client at signupCritical
- Password reset links that never expireHigh
- Sessions that survive logout and password changesHigh
Why these checks: seen in public
Escape analysed more than 5,600 publicly deployed apps built with AI app builders and found more than 2,000 vulnerabilities, over 400 exposed secrets and 175 instances of exposed personal data.
Oct 2025 · Escape · all sources
Lovable reported that from 3 February to 20 April 2026 a backend regression let any logged-in Lovable user read the chat history and source code of public projects; a fix shipped within two hours.
Apr 2026 · Lovable · all sources
Each incident links to the pattern and the self-check you can run today, in the evidence list.
What you receive
- 01Findings report with severity, mechanism and affected path
- 02Fix direction for every finding
- 03Re-check of critical findings after your fixes, within 14 days, included
See a full sample report (synthetic, fictional app) for the exact format.
How it works
- Step 1
Share access
Send the app URL and a test login by email. For code review packages, add read access to the repository.
- Step 2
We test
We run the checklist for your package against the live app, by hand and with scripts, inside the turnaround.
- Step 3
Report and call
You receive the findings report and a plain-English summary. We walk you through it if the package includes a call.
- Step 4
Re-check after fixes
Fix with your developer or your AI tool, then we re-test the critical findings within the re-check window, included.
Findings describe what we observed on the version you gave us access to, on the date of testing. Changes after that date are not covered until re-checked.
Questions about the security sweep
what is a security sweep for an ai built app
A test of secrets, data access and auth against your live app: we look for keys in the JavaScript bundle, try to read other users' rows through the public API, and probe admin routes and permission checks with a normal test account. You get a findings report and a fix direction for each item within 24 hours.
can you check my supabase rls
Yes. The security sweep tests each table your app touches from the browser with the anon key and a signed-in test user, and reports which tables return other users' rows, which have RLS off, and which policies are too broad.
how much does a security audit for a lovable app cost
The security sweep is $290 with a 24-hour turnaround. The pre-launch check is $490 in 48 hours and covers two more categories. Prices are fixed and shown on every package page.
Order the security sweep
$290, report in 24 hours. The email opens with a short template: app URL, builder, stack, what you want checked.
Other packages: Pre-launch check ($490), Ready-to-charge check ($390), Full audit ($1,900). Compare all.