.png)
Building fast shouldn’t come at the compromise of building safely. For too many builders, security has been the thing they know they should care about but don't have the expertise, or the patience, to deal with.
Today we're shipping a new security experience. One that's automatic, invisible where it should be, and fixes things for you.
Starting today, Lovable automatically runs a security scan before you publish, and remembers the context of your app to improve your apps' security. Enterprise users can also schedule deep security scans on a regular cadence to make sure your app security stays up to date.
How it works
When you publish, Lovable runs a background security scan in about 10 to 15 seconds. It checks for common issues, including database misconfigurations, missing RLS policies, and authorization gaps, and can auto-fix the ones that won't affect how your app works. You get one of three results: the scan passes, it returns warnings, or it flags critical issues, which admins can set to block publishing until they're resolved.
What this covers, and when to go deeper
For many projects, especially early-stage ones, the basic security scan is the security coverage that matters most, it checks your project configuration, database schema, RLS, looks for sensitive data exposed on the internet . But it doesn't cover everything.
The basic scan doesn't analyze your application code for logic flaws or vulnerabilities unique to how your app is built. That's what the deep security scan is for, a full AI-powered review of your codebase that takes about 2-4 minutes.
We'd recommend running a deep security scan when you're preparing to launch publicly, handling sensitive user data, or making significant architectural changes. It's not required to publish, but it's how you get a more complete picture. Enterprise workspace admins can also schedule deep security scans to run automatically across all projects, weekly or monthly, so your entire workspace stays covered without anyone having to remember to run a scan.
On top of both scan types, dependency checks run behind the scenes on every edit you make to application dependencies, so your supply chain security is continuously monitored without you lifting a finger.
Auto-fix
Auto-fix is opt-in. When it's on, the agent resolves straightforward, low-risk findings during normal development, making only non-breaking changes that keep your app working. This happens during the basic scan.
How it works:
- Your app is scanned and findings get flagged during the first publishing flow.
- As you continue building, the agent resolves the straightforward, low-risk issues as part of your regular prompts.
Security memory
When you interact with security findings, dismissing, accepting, or providing context, the agent remembers. It builds a model of your project's security profile that both the scanner and the coding agent reference. You can also edit security memory directly to give the agent context on what you’re building. The result: fewer repeat flags, more relevant findings, and a scanner that actually earns your trust over time.
In our testing, security memory reduced ignored findings by about 20% and increased scanning accuracy.
Who this is for
Solo builders. You don't need to know what RLS policies are or how to audit a database. Lovable runs a basic security scan automatically every time you publish and fixes what it can. When you're ready to launch publicly or start handling user data, run a deep scan to catch the things automated checks can't. Combine automated basic security scans, and regular deep security scans for the best protection.
Teams and workspace admins managing security across multiple projects and developers. Enable auto-fix at the org level, and the baseline goes up across every project without anyone having to chase individual fixes. Use publish blocking for workspaces where critical security issues shouldn't ship.
Enterprise customers who need security gates without the wait. The basic security scan replaces the old multi-minute scan as the default publish gate, same protection for the most common issues, a fraction of the time. Deep security scans are available for thorough reviews but running them would never block publishing. Enterprise admins can control exactly where auto-fix applies: externally-published projects, workspace-published, or all. And with scheduled scans, you can run deep security scans across your entire workspace on a weekly or monthly cadence.
What hasn't changed
The publish flow still nudges you to address open findings. Scan-on-publish settings still work, they just run automatically now, which means your builders aren't blocked for minutes to publish.
Getting started
The basic security scan is now available to all users and will run automatically. Auto-fix is available on all plans and opt-in. And when you're ready for a deeper review, the deep security scan is always one click away.
