Lovable app exposed API key: how to find and fix it

Updated 2026-10-14 · Defensive guide for your own app

The fix

1. Rotate first-party and third-party keys that appeared in code or git history, in each provider's dashboard.
2. Store the new key in Secrets, not in the chat or source. Lovable's docs describe detecting pasted keys and guiding you to Secrets.
3. Call the API from a server-side function and have the frontend call that function. A Supabase Edge Function example:

// supabase/functions/generate/index.ts
Deno.serve(async (req) => {
  // 1. Verify the caller (e.g. check the user's JWT with supabase.auth.getUser)
  // 2. Validate input and apply your own rate limit
  const r = await fetch('https://api.example.com/v1/generate', {
    method: 'POST',
    headers: { Authorization: `Bearer ${Deno.env.get('EXAMPLE_API_KEY')}` },
    body: JSON.stringify(await req.json()),
  })
  return new Response(await r.text(), { status: r.status })
})

An unauthenticated proxy just moves the problem: anyone can then spend your API credits through it. Check the user first.

How to check

• Run Lovable's built-in Quick scan and Deep scan from the Security view; the Deep scan covers leaked secrets and unauthenticated endpoints.
• Search the project for sk-, sk_live_, re_, service_role, sb_secret_ and VITE_ variables holding secrets (Vite ships every VITE_ variable to the browser).
• Open your published site, view the JS bundle in DevTools, and search for the same strings.

Why it matters

In our own review of 30 public Lovable and Bolt repos built on Supabase, 33% had at least one critical or high-severity issue (small sample, directional only). Leaked keys and over-broad database access were the recurring themes. Lovable's docs also say its scans help but don't replace a security review.

FAQ

Sources

• Lovable: Security overview
• Vite: Env variables and modes
• Supabase: API keys

This guide is for securing apps you own or are authorised to work on. Facts above are from the official docs linked; check them for changes.