Lovable already checks security. Why Rustine?
Contents
Lovable runs a security scan every time you publish, and that's a good base. Rustine looks at your app from elsewhere: from the outside, like a visitor, then your live database once the site is proven. The two add up.
What Lovable does comes from its documentation and blog, read on 15 October 2026 (links in the table and at the foot of the page). Spotted a mistake? Write to hello@rustine.io and we'll fix it.
Point by point
| Criterion | Rustine | Lovable (read on 15/10/2026) |
|---|---|---|
| When | Whenever you want, and every week with Solo and Pro. | Automatic quick scan on every publish. Deep scan on demand, schedulable on Enterprise only. [1] |
| Where it looks from | From the outside, on the live site: headers, certificate, served JavaScript, exposed files. Then your database and its buckets, after proof. | From the inside, on the project: database access rules, dependencies, MCP server exposure. The deep scan reviews all the code. [1] |
| Secret keys | Looked for in the JavaScript your site actually serves (Stripe, OpenAI, service_role…), from the free scan. | Looked for by the deep scan. Lovable steers you to its Secrets instead of the code. [1][2] |
| Fixing | A prompt to paste into Lovable. AI Fix with Solo and Pro: Rustine writes the code. | Automatic fixing of critical database and dependency findings. “Try to fix all”: 10 free fixes, each one available again 24 hours after use. [1] |
| Penetration test | No. Rustine reads, it doesn't attack: no exploitation, ever. | Aikido connector: a 1 to 4 hour test, announced at $100 per test on 24/03/2026, billed by Aikido. [3][1] |
| What it covers | Any site, built with Lovable, Bolt, Cursor or WordPress, and your GitHub code. | Lovable projects. [1] |
What Lovable's scan does well
- It runs by itself before every publish, without you thinking about it. [1]
- It reads your project from the inside, which no outside scan can do: your database rules, your dependencies, and all your code with the deep scan. [1]
- A workspace can block publishing while a critical issue is still open. [1]
What Rustine adds
- The site as it is live: what the browser actually gets, with your host, your domain and your certificate.
- Your database tried the way a visitor sees it, after proof: how many rows your public key lets anyone read, without reading one.
- A new audit every week, and an email when a newly published flaw hits a version you use (Solo, Pro).
- The same follow-up if your app leaves Lovable: code exported to GitHub, another host, another tool.
What about Supabase's Security Advisor?
- If your Lovable app runs on Supabase, its dashboard has its own alerts: tables without RLS (error), always-true policies such as using (true) (warning), public buckets anyone can list. Look at them, that's what they're for. [4]
When one is enough
- A personal app with no sensitive data: Lovable's scan, plus a look at Supabase's Security Advisor.
- An app with customers, payments or personal data: add an outside view. Lovable itself writes that its tools don't replace a thorough security review. [1]
Scan your site, it's free
Paste your address: the quick scan reads what a visitor sees, nothing more. The details show once you've proven the site is yours.
Free toolsSecurity headers test
Questions
Is Lovable's security scan enough?
For an app with no sensitive data, it's a good base. Once you have customers or payments, add an outside view: Lovable itself says its tools don't replace a thorough review.
Does Rustine change my Lovable project?
No. Rustine reads your live site and, if you connect it, your GitHub repo, read-only. You or your agent apply the fix.
Does Rustine run a penetration test like Aikido?
No. Rustine attempts no attack: it reads what is exposed, and tries your database read-only once the site is proven.
Sources
- Lovable, Security (documentation), read on 15/10/2026
- Lovable, Secrets (documentation), read on 15/10/2026
- Lovable, Announcing pentesting (March 24, 2026), read on 15/10/2026
- Supabase, Performance and Security Advisors, read on 15/10/2026