I Scanned Random Lovable Projects for Security Flaws. Here's What I Found.

I picked random public repos from Lovable's GitHub organization and ran them through a security scanner. The first result stopped me cold. The Scan Project: A salon booking app built with Lovable. TypeScript, React, Firebase. Standard vibe-coded stack. Score: 28/100. Grade F. In 50 files, the scanner found: .env file committed to the repo. Database passwords, API keys, everything. Sitting in plain text in the git history. Even if you delete it now, it's in every previous commit. Firebase API key hardcoded in a public JavaScript file. public/firebase-messaging-sw.js had the key right there. Anyone who opens DevTools can copy it. No .gitignore for secrets. The project never told git to ignore .env files. Every deploy pushed secrets to GitHub. Firebase config exposed client-side without server validation. The app trusts whatever the client sends. No server-side check. Why This Matters This isn't a bad developer. This is what Lovable outputs by default when you prompt "build me a salon boo