Lovable security scan vs Leakcade: what each one checks

Updated Oct 22, 20264 min read

The Lovable security scan is free, runs on every publish and reviews your live database rules. That's more than we can do. Lovable's docs describe what its scan covers. Below is how that compares with a Leakcade report, and when the built-in scan is enough. We make Leakcade, so check the sources.

What Lovable's security scan covers

Lovable's docs describe two built-in scans, both free to run:

• Quick scan runs every time you publish. It reviews database access rules (tables without row-level security, rules that let everyone through, leaked-password protection turned off), audits npm dependencies for known vulnerabilities and flags an MCP server without authentication.
• Deep scan reviews your application code for access control, endpoints anyone can trigger, injection, leaked secrets, payments, authentication and exposed personal data. You start it yourself from the Security view. It doesn't run automatically as you work.

Workspaces can also connect Wiz (static analysis) and Aikido (AI pentests on the running app). Lovable's docs say the tools "cannot guarantee complete security" and suggest a professional review for apps with sensitive data.

Where Lovable is ahead

• It checks the live database. The Quick scan reviews the database rules themselves, so a policy changed in the dashboard is covered. We only read migrations in the repo.
• It's free and runs on every publish without you doing anything.
• Fixes in place. Try to fix all draws from 10 free fixes (shared with build-error fixes, each back after 24 hours), and auto-fix can handle eligible database and dependency findings while you build.
• Pentest option. With Aikido connected, AI agents send real payloads to the running app. We never run your app.

Where an outside repo review adds something

• Git history. We run gitleaks over the files and the last 50 commits, so a key you pasted and deleted a while ago still shows up, as long as it's within those commits. Lovable's docs mention secrets "in your source code or repository" for the Deep scan but don't say whether old commits are included.
• Code from other tools. With GitHub sync, many people edit a Lovable project in Cursor or Claude Code too. We read whatever is in the repo, whoever wrote it.
• Dependencies that don't exist. We check every package name against npm and PyPI (slopsquatting). Lovable's dependency audit is about known vulnerabilities, and its docs say only critical ones become findings.
• A second opinion. The tool that wrote the code also checks it in Lovable. A separate review with file and line, a fix prompt for each finding and a PDF you can share is a different angle.

Lovable security scan vs Leakcade side by side

Lovable column from Lovable's security docs, checked Oct 22, 2026. Features change, so check the current docs.

Which one should you use?

1. Start with Lovable's scans

   Open the publish dialog, read the Quick scan result, then run the Deep scan from the Security view. It's free, so there's no reason to skip it.

2. Fix the critical findings

   Use Try to fix, or fix by hand, and re-run the scan. Ignore a finding only with a written reason.

3. Add an outside review if it fits

   A repo review makes sense when you edit code outside Lovable, ever pasted keys into code, or want a report to show someone. If you build only in Lovable and the Deep scan is clean, you may not need us.

4. Test it yourself

   Use a second account and a logged-out browser on your own app. The Lovable security checklist has the steps.

Fix prompt you can paste

Run a security review of this Lovable project before we publish. List
every table and its RLS policies and flag any that let everyone through or
only check for a login on update and delete. List every key or secret you
can find in the code and the git history, and tell me which to rotate.
Say so if you can't see the history. Check that every edge function
that changes data checks who is calling. File and line for each finding.

How Leakcade checks this

We read the public GitHub repo your Lovable project syncs to: gitleaks over the files and the last 50 commits, Semgrep, OSV-Scanner, package-name checks, our Supabase migration checks (RLS, insert, delete and storage policies, security definer functions, user_metadata roles), and an AI review. We don't see your live database, so dashboard changes and built-in backend settings stay with Lovable's Quick scan.

Sources

1. Lovable docs: Security overview
2. Lovable docs: Project security view
3. Lovable docs: GitHub sync
4. Lovable docs: Security best practices

FAQ