How to check if my Lovable app is vulnerable?

The fastest way to assess your Lovable app security is to run an automated security scan that checks for the most common AI-generated code vulnerabilities. Key areas to verify include whether your Supabase service_role key is exposed in client-side JavaScript, whether RLS is enabled and properly configured on all tables, and whether security headers are present. You should also check for open API routes that lack authentication and input validation. UNPWNED runs 700+ security checks across 40 scanners specifically relevant to Lovable and other AI-built applications.