---
name: Lovable Security Scan
slug: lovable-security-scan
url: https://lovable.dev/security
category: Database
bestFor: "The scan Lovable runs on a project you built there, including a check of Row Level Security before publish."
freeTier: yes
price: "Included with Lovable"
checks:
  - source
  - supabase-rls
freeTierNote: "Lovable's security page says a basic scan runs automatically on every publish, in about 10 to 15 seconds, and checks database configuration, RLS policies, and cloud project settings. A deep scan is available on demand and takes about 3 minutes, analyzing the codebase. Dependency checks run in the background on every edit. Recurring deep scans across projects are described for Business and Enterprise workspaces. The page does not list a separate price for the basic scan."
verifiedOn: "2026-10-14"
sources:
  - https://lovable.dev/security
  - https://docs.lovable.dev/integrations/supabase
unknowns:
  - "Whether the on-demand deep scan is included on the free Lovable plan. The security page does not tie that scan to a dollar price."
---

This scan is part of Lovable, not a tool you point at an unrelated URL. The Supabase integration doc says Lovable runs automated checks against the database configuration, including RLS coverage, and that missing RLS policies are the most common way app data gets exposed. Confirm the policies in the Supabase dashboard anyway. The scan does not replace reading the policies.