FAQ & glossary
Straight answers to the questions founders ask before running a scan, plus a plain-English glossary of the security terms you will see in a report.
The quick answers first. A glossary of the words you will meet in a report is at the bottom.
Is my Lovable app secure?
There is no way to know without looking at the code, and "it works" does not tell you. Apps built with Lovable, Bolt, Cursor and v0 tend to ship with the same handful of holes: open databases, keys left in the code, admin pages with no login. A scan reads your repo and tells you which of those are actually in your app. Run one and you will have a real answer instead of a guess.
Do you keep my code?
No. Your source code is never stored. It is read inside an isolated scan job and discarded the moment the scan ends. We keep the report, meaning the findings, the score, and for the most serious findings a short excerpt of the surrounding code, but never the repo and never an excerpt of a leaked secret. See Your code and your data for the full detail.
What does a scan cost?
You start free with one scan a month, no card needed. A free scan shows you every finding it hits, with your real score and grade. What it holds back is the fix prompt and the per-finding AI fixes. When you want those, a 6-scan pack is ₹499 / $6, one price worldwide. If you scan often, the Founder plan is ₹1,499 / $19 a month for 36 scans a month. See Plans for the details.
Do I need to understand security to use this?
No. That is the whole point. You get a score, a letter grade, and findings written without jargon, each one saying what the problem is and why it matters. Every finding comes with a fix you can paste back into your AI builder. You do not have to read the code.
What does a scan check for?
Leaked secrets, exposed data, vulnerable dependencies, and the mistakes AI coding tools tend to ship: open admin pages, weak auth, risky CORS. It also covers injection, cross-site scripting, missing authentication, mass assignment, disabled row-level security and more. Common vulnerabilities lists the full set.
How do I fix what it finds?
Each finding comes with a fix prompt. It is a copy-paste instruction written for your specific AI builder, delivered in small steps so the tool applies one change at a time. You paste it back into the tool that wrote the app. How a scan works covers the flow end to end.
Can I check that a fix worked?
Yes. After you apply a fix, you can rescan the repo. If the finding is gone, it will not appear in the new report. That is the fastest way to confirm a fix actually landed.
Do you need write access to my repo?
No. Access is read-only, on the one repo you pick. No pushes, no pull requests, and no reading repos you did not choose. The scan only ever looks.
What happens if I delete my account?
Your GitHub profile and your GitHub token are deleted, and the data tied to your account goes with it. Payment records, which are only an amount and a date, are kept because tax law requires it. Support messages are kept but unlinked from you. You can also export or erase your data yourself from Settings at any time.
Glossary
| Term | Plain-English meaning |
|---|---|
| RLS (row-level security) | A database setting that decides which rows each user is allowed to read or change. Turned off, anyone can read everyone's data. |
| CORS | The rule that says which other websites are allowed to call your app's backend. Set too open, any site can make requests as if it were yours. |
| Secret / API key | A password-like string that lets code talk to a service such as a database or a payment provider. If one leaks, whoever finds it can act as you. |
| Injection | Tricking an app into running attacker-supplied input as a command or a database query, instead of treating it as plain data. |
| XSS (cross-site scripting) | A hole that lets an attacker run their own code in another user's browser through your app, often to steal sessions or data. |
| Dependency | A piece of outside code your app pulls in to save writing it yourself. A dependency with a known hole becomes your app's hole. |
| Severity | How serious a finding is, usually critical, high, medium or low. It sorts the report so the most dangerous issues sit at the top. |
| Authentication | The check that confirms who a user is, usually a login. Missing or weak, a stranger can act as any user. |
| Mass assignment | When an app blindly accepts whatever fields a request sends and writes them all to the database, letting a user set fields they should not, like making themselves an admin. |
Try a scan
The clearest answer to "is my app safe" is a scan of your own app. Sign in with GitHub and run one free, one a month, no card: start a scan.