.png)
Building fast shouldn’t come at the compromise of building safely. For too many builders, security has been the thing they know they should care about but don't have the expertise, or the patience, to deal with.
Today we're shipping a new security experience. One that's automatic, invisible where it should be, and fixes things for you.
Starting today, Lovable automatically runs a security scan before you publish, and remembers the context of your app to improve your apps' security. Enterprise users can also schedule deep security scans on a regular cadence to make sure your app security stays up to date.
How it works
When you click publish, Lovable runs a basic security scan in the background. In about 10–15 seconds, it checks for the most common and impactful issues, database misconfigurations, missing RLS policies, authorization gaps, and auto-fixes* anything that won't affect the usability of your apps during your next chat session. By the time the publish dialog finishes loading, you'll see one of three things:
- Basic security scan passed
- Warnings found
- Critical issues found — if you or your workspace admin has enabled publish blocking (available to Enterprise), you'll need to fix these first.
auto-fixing is an opt-in feature.
What this covers, and when to go deeper
For many projects, especially early-stage ones, the basic security scan is the security coverage that matters most, it checks your project configuration, database schema, RLS, looks for sensitive data exposed on the internet . But it doesn't cover everything.
The basic scan doesn't analyze your application code for logic flaws or vulnerabilities unique to how your app is built. That's what the deep security scan is for, a full AI-powered review of your codebase that takes about 2-4 minutes.
We'd recommend running a deep security scan when you're preparing to launch publicly, handling sensitive user data, or making significant architectural changes. It's not required to publish, but it's how you get a more complete picture. Business and Enterprise workspace admins can also schedule deep security scans to run automatically across all projects, weekly or monthly, so your entire workspace stays covered without anyone having to remember to run a scan.
On top of both scan types, dependency checks run behind the scenes on every edit you make to application dependencies, so your supply chain security is continuously monitored without you lifting a finger.
Auto-fix: the agent handles security for you
For each initial security scan, you can also enable auto-fix as an opt-in feature. With auto-fixes, the Lovable agent starts addressing security findings automatically, right inside your normal coding flow.
Here's how it works:
- Your app is scanned and findings get flagged during the first publishing flow.
- As you continue building, the agent resolves the straightforward, low-risk issues as part of your regular prompts.
The agent will only attempt to fix non-breaking changes, meaning nothing that could impact the way your app works.
Security memory: the scanner that learns
When you interact with security findings, dismissing, accepting, or providing context, the agent remembers. It builds a model of your project's security profile that both the scanner and the coding agent reference. You can also edit security memory directly to give the agent context on what you’re building. The result: fewer repeat flags, more relevant findings, and a scanner that actually earns your trust over time.
In our testing, security memory reduced ignored findings by about 20% and increased scanning accuracy.
Who this is for
Solo builders shipping real projects. You don't need to know what RLS policies are or how to audit a database. Lovable runs a basic security scan automatically every time you publish and fixes what it can. When you're ready to launch publicly or start handling user data, run a deep scan to catch the things automated checks can't. Combine automated basic security scans, and regular deep security scans for the best protection.
Teams and workspace admins managing security across multiple projects and developers. Enable auto-fix at the org level, and the baseline goes up across every project without anyone having to chase individual fixes. Use publish blocking for workspaces where critical security issues shouldn't ship.
Enterprise customers who need security gates without the wait. The basic security scan replaces the old multi-minute scan as the default publish gate, same protection for the most common issues, a fraction of the time. Deep security scans are available for thorough reviews but running them would never block publishing. Enterprise admins can control exactly where auto-fix applies — externally-published projects, workspace-published, or all. And with scheduled scans, you can run deep security scans across your entire workspace on a weekly or monthly cadence — so nothing falls through the cracks.
What hasn't changed
The publish flow still nudges you to address open findings. Scan-on-publish settings still work, they just run automatically now, which means your builders aren't blocked for minutes to publish.
Getting started
The basic security scan is now available to all users and will run automatically. Auto-fix is available on all plans and opt-in — head to your workspace settings to turn it on. And when you're ready for a deeper review, the deep security scan is always one click away.
