What security testing should I do before launching a Lovable app?

Before launching, scan for exposed API keys and secrets in your client-side bundle, verify that Row Level Security is enabled with proper policies on every Supabase table, and confirm that security headers are configured on your deployment. Check that all API routes require authentication where appropriate and that user input is validated server-side. Test that your application handles errors gracefully without leaking stack traces or internal information. UNPWNED checks the externally observable portions in one scan. Free reports show completed finding titles and severities; paid reports add full detail and remediation guidance. Authentication, RLS policy, and server-side validation still require direct review.