What security testing should I do before launching a Lovable app?

Before launching, scan for exposed API keys and secrets in your client-side bundle, verify that Row Level Security is enabled with proper policies on every Supabase table, and confirm that security headers are configured on your deployment. Check that all API routes require authentication where appropriate and that user input is validated server-side. Test that your application handles errors gracefully without leaking stack traces or internal information. UNPWNED performs all of these checks in a single automated scan, giving you a security score and actionable fix recommendations for your Lovable app.