Hullwise vs Lovable Security Scan
Lovable checks projects built in Lovable from the inside: a quick scan runs on publish and checks database rules and dependencies, a deep scan on request also reviews the code. Both are free; AI fixes cost credits after ten free ones.
Hullwise requests the page once and reads security headers, certificate, email protection, software versions, the served HTML and the JavaScript files the page includes. Below is where that overlaps with Lovable Security Scan.
Checks side by side
Where Lovable Security Scan does more, the table says so and highlights it in green. Here that applies to: Versions with known vulnerabilities, Secrets in the HTML, Explanation of findings.
| Check | Hullwise | Lovable Security Scan |
|---|---|---|
| Security headers | Yes, six headers checked for presence, plus server and technology disclosure | Not mentioned |
| TLS and certificate in depth | Basics: valid, expiry date, TLS 1.0 or 1.1. No review of cipher suites | Not mentioned |
| SPF and DMARC | Yes, via public DNS, plus MTA-STS or DANE and the limit of 10 SPF lookups | Not mentioned |
| Versions with known vulnerabilities | Yes, detected JavaScript libraries live against OSV.dev, prioritized by CISA KEV (actively exploited) and FIRST EPSS, plus end of support via endoflife.date and insecure WordPress versions via WordPress.org | Yes, the project's npm dependencies against known vulnerabilities; only critically rated ones become findings Lovable Security Scan does more here |
| Technology detection | Yes, with the rules of webappanalyzer (a fork of the Wappalyzer rules) and Retire.js, plus platforms and hosts such as Lovable, Bolt, v0, Replit, Vercel, Netlify and Supabase | Not mentioned |
| Secrets in the HTML | Yes, the same patterns as in the JavaScript files, also in embedded data such as __NEXT_DATA__, plus Google API keys as a notice. We report the type and where it was found, the value only shortened | Yes, in the deep scan: secrets in the source code and repository. Plus a notice when someone pastes a key into the chat Lovable Security Scan does more here |
| Keys in the JavaScript files of vibe-coded apps | Yes, 16 types of our own for secret keys and credentials, such as Supabase service_role, OpenAI, Anthropic, Stripe and AWS, plus over 100 providers from the gitleaks rules. We read up to 50 files from the same domain: included files, parts loaded when switching pages, for Next.js the parts of every page, and configuration files such as /config.json that the code fetches on startup. We report the type and where it was found, the value only shortened, for example sk_live_…9f2A, never in full | Checks the source code in the project, not the files the live site serves |
| Third-party scripts without SRI | Yes | Not mentioned |
| Cookies | Yes, Secure and HttpOnly | Not mentioned |
| Malware and blocklists | No | Not mentioned |
| Explanation of findings | One or two sentences per finding in English or German, with a link to the fix guide. Without a paid plan, two findings come in full, all of them with Business | Findings in the project's security area, AI fixes right in the project (ten fixes free, then credits) Lovable Security Scan does more here |
| API | Yes, with a free key 100 checks per hour and a shortened report, full with Business. No REST API without a key, only MCP | Not mentioned |
| MCP for AI agents | Yes, for Claude, ChatGPT, Cursor, Codex and VS Code. Without a key 20 checks per hour and a shortened report, full with Business | Checks whether an MCP server the app exposes is reachable without sign-in. The security docs don't name MCP access to the scan itself |
| Weekly monitoring | Yes, with Business up to 10 domains, with an email as soon as a grade drops | Scheduled deep scans across projects only on the Enterprise plan |
| Manual review (audit) | Yes, from €1,500 per application, only after proof of ownership | AI pentesting via the Aikido integration, billed separately by Aikido |
As of October 2026. "Not mentioned" means the Lovable Security Scan pages linked below say nothing about it. The feature may still exist there. What Hullwise checks in detail is described under How we check.
When Lovable Security Scan is the better fit
- You build with Lovable yourself and have access to the project. Then the quick scan checks database rules (Row Level Security), storage rules and dependencies for free before every publish, exactly what we can't see from the outside.
- You want findings fixed by AI right in the project.
You can use both tools side by side. Hullwise gives you an overview across six areas; for a single area, Lovable Security Scan takes a closer look.
What your AI agent can do with it
Hullwise has an MCP server. Add it to Claude, ChatGPT, Cursor, Codex or VS Code, and your agent checks sites itself with scan_website and shows what is checked with list_checks. Over MCP, you get 20 checks per hour without a key and 100 with a free key. The REST API always requires a key. Without a paid plan, the API and MCP return two findings in full; with Business, the complete report.
Lovable's security docs name no MCP access and no API for the scan itself. Lovable does check MCP servers that an app exposes.
What happens after a finding
Lovable checks the project from the inside, Hullwise the live site from the outside, for any platform. That fits when you want to check apps whose project you have no access to, for example from agencies or business departments, or when you need evidence for management and auditors. Lovable's docs don't mention headers, certificates, email protection, data protection or DNS. Using both makes sense.
At Hullwise, every finding leads to a guide on how to fix it. With Business, we then check up to 10 domains every week and email you as soon as a grade drops (€149 per month). The Security Audit is a manual review that starts only after you prove ownership. It also covers what is not visible from the outside, such as open databases and access permissions. It starts at €1,500 per application.
All trademarks belong to their owners and are not affiliated with Hullwise. Information about Lovable Security Scan is based on its own pages, as of October 2026.
Is your app
watertight?
Hullwise finds the leaks before someone else does: exposed keys, database credentials and outdated software. Every finding comes with steps to fix it.
Click a finding to mark it as fixed.
Ship fast. Stay hullwise.