Scan like an attacker, safely
Exposed .env and .git files, secrets in JavaScript bundles, Supabase and Firebase rules, TLS, headers, email spoofing and more.
Vigavo for Lovable
Shipped with Lovable?We stay awake.
Lovable makes building fast. We check what it published: exposed keys, open Supabase tables, missing headers, with fix prompts you paste back into Lovable.
Free. No signup. Read-only checks from the outside.
What we check on Lovable
Lovable apps usually run on Supabase. Scanning works for every Lovable app, whatever the backend.
Secrets in the bundle
We search the JavaScript Lovable generated for keys that should never be public.
Database rules
If the app uses your own Supabase project, we test its Row Level Security with the public key.
Prompts for Lovable
Every critical finding has a prompt written for Lovable's chat.
About Lovable Cloud backups
Lovable Cloud databases live inside Lovable's own account, so Vigavo cannot connect to them for backups. Scanning and monitoring still work fully. To get backups, connect the app to your own Supabase project (or export your data from Lovable), then connect that project to Vigavo.
Everything a small team forgets to check
Findings ranked by what an attacker would try first, with the fix right next to each one.
Watch for changes
Scheduled scans compare against the last result, so you hear about a new leak once, not every day.
Backups that restore
Encrypted database snapshots, verified by an actual restore and row counts.
Fix prompts
Each critical finding comes with a prompt you can paste into Cursor, Claude Code, Lovable or Bolt.
Alerts without noise
Deduplicated alerts, daily or weekly digests, and a clear grade from A to F.
Questions
Can you back up my Lovable Cloud database?
No. Lovable Cloud gives no outside database access. Scans and monitoring work; backups need your own Supabase project.
Do I need to change anything in Lovable?
No. Enter the published URL and scan.
Will the fix prompts work in Lovable?
Yes, they are plain English instructions with the exact table, file or header to change.
Is the scan safe for my site?
Yes. We only make the same read-only requests any visitor's browser could make. Nothing is changed and nothing is exploited.
What do you store?
The scan result. Free scans are deleted after 30 days.