Does publishing expose my project and code?

No. Publishing only makes your website public at a URL. Your Lovable project remains private—only invited collaborators can access it. Your code is protected unless you explicitly sync to GitHub or download it. API keys and secrets are never included in exports. Keep sensitive keys in Cloud → Secrets or Supabase Edge Function secrets.