8 problems, most important first.
Mark a problem fixed to see what the grade would be. Then re-check: the grade only counts once the scanner sees the fix on your live site.
- Every fix written for your builder, with text to paste
- What a stranger could actually read from your data
- Re-check as often as you like for 7 days
Security
GRADE F · 2 / 100The Supabase table "tasks" answers to anyone who asks, without a login. Row Level Security is switched off, so the public key that ships with every Lovable site is enough to read everything in it.
// one masked row from "tasks" (real values are never shown)
{
"id": "c1f…",
"user_id": "8a2…",
"title": "Call the dentist",
"notes": "ask about the in…",
"due_at": "2026-09-1…",
"email": "m…@gmail.com",
"created_at": "2026-08-3…"
}GET /rest/v1/tasks?select=*&limit=1 with the public anon key -> 200 OK, 1 row returned. Range request reports 1,284 rows in total.
In Supabase open Table Editor > tasks > "RLS disabled" and enable Row Level Security. Then add one policy: "Enable read for own rows" with the expression auth.uid() = user_id. Paste this into Lovable: "Enable RLS on the tasks table and add a policy so users can only select, insert, update and delete rows where user_id = auth.uid()."The site still answers on plain http:// and does not send visitors to the secure version. On a café network anyone can read or change what those visitors see.
GET http://tidytasks.lovable.app/ -> 200 OK (no Location header)
Lovable: Settings > Domains > enable "Redirect HTTP to HTTPS". On Vercel and Netlify this is already the default; check your custom-domain settings if you connected one.Your backend answers with "any origin may read this, including credentials". A malicious page a logged-in user visits can quietly fetch their data.
Origin: https://deckproof-cors-probe.example -> Access-Control-Allow-Origin: * with Access-Control-Allow-Credentials: true
Reply with your own origin only. Paste into your builder: "Set the CORS allow-origin header to https://tidytasks.lovable.app instead of * and remove allow-credentials for other origins."Without a CSP, any script that gets injected into the page runs with full access to it.
content-security-policy: (missing)
Add the header Content-Security-Policy: default-src 'self'; img-src 'self' data: https:; style-src 'self' 'unsafe-inline'; script-src 'self'. Start in report-only mode (Content-Security-Policy-Report-Only) for a day, then enforce.EU legal information
GRADE D · 56 / 100No provider page was found at the usual addresses or in the footer. German law expects one on business sites that people in Germany can reach (§ 5 DDG). General information, not legal advice.
Checked /impressum, /imprint, /legal, /about and every footer link: none matched.
Add a page at /impressum with your name, postal address, email and, where applicable, your VAT ID, and link it from every footer. Paste into your builder: "Add an Impressum page at /impressum with these details and link it in the footer on every page."Two font files are loaded from fonts.googleapis.com, which sends every visitor's IP address to Google on each visit. Since a 2022 Munich court ruling this is regularly the subject of warning letters in Germany. General information, not legal advice.
<link href="https://fonts.googleapis.com/css2?family=Inter:wght@400;600"> and 1 request to fonts.gstatic.com
Self-host the fonts: download the two files, put them in /public/fonts, and replace the Google link with @font-face rules. Paste into your builder: "Remove the Google Fonts link and self-host Inter from /public/fonts with @font-face."Quality
GRADE B · 88 / 100The HTML that arrives from the server contains no text; everything appears only after JavaScript runs. Search engines and link previews get a blank page.
Server HTML: 0 words in <body>, 1 <div id="root">. After render: 412 words.
Turn on server rendering or pre-rendering for the public pages. Paste into your builder: "Pre-render the landing page and the pricing page to static HTML so they contain their text without JavaScript."Browsers show a blank tab icon.
GET /favicon.ico -> 404, no <link rel="icon">
Add a 32x32 PNG or an SVG as /favicon.ico or via <link rel="icon">. Most builders have a "favicon" field in the project settings.