How to check if a Lovable app leaks API keys

Lovable builds a frontend and deploys it. The JavaScript that loads in the browser is public. A key compiled into that file is a key your visitors can copy.

Check in this order:

• Stripe: a publishable key is meant for the client. A secret key is not. If the secret is in the bundle, roll it in the Stripe dashboard and move the call to a server.
• OpenAI and Anthropic: those keys belong on a server. A browser call with the key bills you and can be stolen.
• Supabase: the anon key is expected. The service_role key is not. See the guide on anon keys for the RLS check.
• Env files: a public /.env is the raw secrets, not a hint inside minified code. It should not be on the internet.
• Names: NEXT_PUBLIC_ and VITE_ are inlined into the client. A name containing secret, token, or password is a signal the value was meant to stay private.

Paste the live Lovable URL into the scan. VibeSafe uses GET and HEAD only, redacts secret values in the saved report, and returns a free letter grade. Details and fix prompts unlock after you pay. The category breakdown unlocks after an email.

Only scan sites you own or are authorized to test.