Unspill vs Lovable Security Scan vs Supabase Security Advisor: what each one checks, and what it can't see
Short version: Lovable's Security Scan and Supabase's Security Advisor are free, made by the platforms themselves, and good at what they do. If you use those platforms, run them. They look from the inside (your code, your database). Unspill looks from the outside, the way a stranger with a browser sees your live app. The three overlap a little and miss different things, so they work best together. Everything below about Lovable and Supabase comes from their official docs, linked at the bottom.
Scan your live app free Passive, no signup, never touches your database.
1. Lovable Security Scan: inside your Lovable project
According to Lovable's security docs, a Quick scan runs automatically every time you publish. It reviews your database (tables without Row Level Security, rules that let everyone through, and whether leaked-password protection is off), audits dependencies (only critical vulnerabilities become findings), and checks connected MCP servers. A Deep scan, which you start yourself, reviews all your application code: access control, unauthenticated endpoints, injection, secrets leaked in source, payments, authentication and data exposure. Running the scans is free. 'Try to fix all' comes with 10 free fixes, and conversational security reviews use credits. Lovable also detects API keys pasted into chat and points you to its Secrets feature. There are optional integrations with Wiz and Aikido. The docs say plainly that these tools cannot guarantee complete security.
2. Supabase Security Advisor: inside your database
Supabase's Advisors run deterministic checks (lints) against your project's database. You can find them in the Studio dashboard (Security, Performance and Health Advisors), through the Supabase MCP server's get_advisors tool, the CLI (supabase db advisors) and the Management API. The security lints include RLS disabled on a table in public (rated ERROR), policies that exist while RLS is disabled, RLS enabled with no policies, security definer views, auth.users exposed through the API, RLS policies that reference user metadata, materialized views reachable from the API, sensitive columns exposed, overly permissive RLS policies, public storage buckets that allow listing, pg_graphql exposure, security definer functions that client roles can execute, and functions with a mutable search_path. Supabase notes that some findings may be intentional, so read each one rather than blindly 'fixing' it.
3. Unspill: outside your live app
Unspill fetches only what any visitor's browser can fetch from your deployed URL: the HTML, the JavaScript bundles and a few well-known paths. It flags secret keys shipped in the front end (Supabase service_role, Stripe secret, OpenAI/Anthropic/AWS keys, private keys), a downloadable .env file or .git folder, public source maps, missing security headers, wide-open CORS and insecure cookies, and it notices when an app talks to Supabase or Firebase so you know to check the rules. It works on any host or builder (Lovable, Bolt, v0, Replit, Cursor or hand-written code) and needs no access to your project. It is passive: it never logs in, never sends attack payloads and never touches your database.
4. What each one can't see
Lovable's scan covers projects in Lovable. If your app is built or hosted elsewhere, or you changed it after exporting, the scan doesn't apply to it. Supabase's Advisor looks at the database, so it can't see what your front end ships: a service_role key bundled into JavaScript, an exposed .env file or missing headers sit outside the database. Unspill can't see your database rules, your server code, or whether one signed-in user can read another user's rows. A clean Unspill report doesn't mean your RLS is right, and a clean Advisor doesn't mean your bundle is clean.
5. When to use which
Building in Lovable: let the Quick scan run on every publish and run a Deep scan before launch or after big changes. Using Supabase (from any builder): open the Security Advisor after every schema change and fix or knowingly accept each finding. Before you share a link or launch, and after any deploy: run an outside check like Unspill on the live URL, because that's what attackers actually see, including things that only show up after the build and hosting step (bundled keys, source maps, served .env files, headers). All three are free, and running all three takes a few minutes.
6. A practical routine
1) Fix every ERROR-level Supabase Advisor finding, starting with RLS disabled in public. 2) In Lovable, clear the Quick scan findings and run a Deep scan. 3) Deploy, then scan the live URL with Unspill and fix anything critical or high: rotate any key it finds, because it has already been public. 4) Re-run all three after major changes. If you want to see what an outside scan finds before using it on your own app, look at our sample report, a real scan of our own test app with fake secrets planted in it.
Fix guides for these issues
- Verify Supabase Row Level Security: Your Supabase anon key is public by design, so Row Level Security is the only thing protecting your tables. Run these SQL checks to find tables with RLS off or policies that let anyone read everything.
- Supabase service_role key exposed: A Supabase service_role (or sb_secret_) key in front-end code gives anyone full read/write access to your database, bypassing Row Level Security. Here is how to rotate it and fix the leak.
- Exposed .env file: If https://yourapp.com/.env downloads your environment file, every secret in it is public. Remove it from the deployed output, block dotfiles, and rotate every key.
- Public source maps: Production .map files let anyone rebuild your original front-end code, comments and internal routes. Disable them in Vite or Next.js, or upload them privately to your error tracker.
FAQ
Are Lovable's Security Scan and Supabase's Security Advisor free?
Yes, according to their docs. Lovable says running scans is free (automatic fixes beyond the included 10 and conversational reviews use credits), and Supabase's Advisors are part of the dashboard, CLI and API. Unspill is free too.
If I run Supabase's Security Advisor, do I still need an outside scan?
Yes. The Advisor checks your database. It can't see a secret key bundled into your front-end JavaScript, a public .env file or missing headers, because those live in your deployed site, not your database.
If Unspill gives me an A, is my Supabase data safe?
Not necessarily. Unspill is passive and outside-only, so it can't read your RLS policies or test whether one user can read another's data. Use the Supabase Security Advisor and test your policies for that.
Does Unspill replace Lovable's Deep scan?
No. A Deep scan reads your application code. Unspill sees only what your live site serves publicly. They catch different problems.
Sources
- Lovable docs: Security (Security Scan, Quick and Deep scans)
- Supabase docs: Database Advisors (Security Advisor and lints)
- Supabase docs: Row Level Security
- Supabase docs: API keys
- Unspill sample report (our own test app)
Last checked against these sources on 2026-10-26. Platforms change; when in doubt, the official docs win.