How to check if your Lovable app leaks API keys

Why this happens

AI builders often put keys in client code or NEXT_PUBLIC_ / VITE_ env vars. Anything in the browser bundle is public. Research on vibe-coded apps keeps finding the same pattern: secrets and open databases shipped by default.

Example evidence: SymbioticSec reported that in a scan of 1,072 vibe-coded Supabase apps, 98% had at least one security flaw (study). Wiz documented the Moltbook incident where missing Supabase RLS exposed large volumes of tokens and emails (Wiz report).

Steps (manual)

1. Open your live app → DevTools → Network → reload → open large .js files.
2. Search for sk_live_, sk-, AIza, service_role, eyJ JWTs.
3. If you find a secret key, rotate it in the provider dashboard immediately.
4. Move privileged calls to a server/Edge Function; keep only publishable/anon keys in the client.

Faster path

PreflightVibe fetches your HTML and same-origin JS, scans for common secret patterns, and grades the result. It is read-only — no writes, no exploits.