Lovable
Checking Lovable apps before you ship them
A generated app that works in the preview is not the same as one that is safe to put on a domain. The difference is a short list of checks, and it is worth running before launch.
Take it apart before you sign it off.
The three questions worth answering before launch
First, does anything secret reach the browser? Second, can one user reach another user's data by changing an identifier? Third, does the page still work when a request fails?
Those three account for nearly every serious issue found in generated apps, and none of them require reading the whole codebase to answer.
Then the surface
Placeholder copy, invented statistics, dead links and images with no provenance are not security problems, and they are what a visitor notices. Run the content and document checks as one pass before the domain goes live.
What Lovable output typically gets wrong
Keys in the browser bundle
A provider key called directly from client code, readable by anyone who opens developer tools.
Authorisation on the route, not the data
Screens hidden behind a login while the underlying records remain readable by id.
Unlabelled form fields
Inputs identified by placeholder text, which disappears on focus and cannot be announced.
Placeholder links and copy
Example domains and bracketed instructions left in a page that now has a real domain.
What it produces
- Full applications generated from a prompt
- Client-side calls to model providers
- Forms and auth flows assembled from components
- Marketing pages alongside the app
One file
The findings are the same whoever wrote it.
Paste the output and the console returns what the rules observed, with severities you can argue with.