The anon key is normal. The service role is not.
Supabase expects the anon key in the browser. A service_role key in the same bundle bypasses every policy. The scan looks for that role and does not print the key.
For Lovable builders
Your Lovable app is public. The keys might be too.
Lovable gets a real site online fast. The usual leftovers are a service-role key in the client, tables without Row Level Security, and a noindex tag from preview. WebFixScore reads the public URL only and lists those problems. The $9 report turns each one into a prompt you can paste back into Lovable, Cursor, or Bolt.
Tables that answer without a login
If the anon key can count rows in a customer or leads table, the scan says so. It stores the table name and the count, never the rows.
Preview settings left on
noindex, a missing title, and an empty canonical are common on the first publish. Search and answer engines then ignore the app you just shipped.
What the scan looks for
- Service-role JWTs in public scripts
- Supabase tables readable with the anon key
- Security headers and HTTPS
- noindex, title, and sitemap
- PageSpeed on mobile
Will you log into my Supabase project?+
No. If the anon key is already in the page, we use only that key to ask whether tables return a count. We cancel the body and do not save rows.
Can I paste the fix into Lovable?+
Yes. The paid report includes a prompt written for that exact issue, plus plain steps if the site is also on WordPress, Wix, or Squarespace.