How to secure a Lovable app?

Start by enabling Row Level Security on every Supabase table and writing proper RLS policies that restrict data access per user. Rotate any API keys that may have been exposed in client-side code, especially the Supabase service_role key. Add security headers like Content-Security-Policy, X-Frame-Options, and Strict-Transport-Security to your deployment configuration. Implement rate limiting on API endpoints and validate all user input on the server side. UNPWNED checks the externally observable header, secret-exposure, Supabase anonymous-access, endpoint, rate-limit, and error-disclosure portions. Paid reports add remediation guidance for completed findings; RLS policy and server-side validation still require direct review.