What is a code audit?

What does a code audit answer that the screens cannot?

An AI-built app has usually never been read by anyone. An audit is the first reading, and it answers the questions the screens cannot: who can reach which data, what happens on a retry, where the secrets are, what breaks if two people act at once.

Which areas does a code audit check?

A code audit checks five areas: access control, which is first on the OWASP Top 10:2025; secrets and configuration; data, including row-level security, migrations and backups; reliability, such as retries, duplicates and error handling; and maintainability, meaning tests, duplication and dependencies. Each finding is ranked by risk:

• Access control: broken access control is first on the OWASP Top 10:2025.
• Secrets and configuration: keys in client code, permissive defaults.
• Data: row-level security, migrations, backups.
• Reliability: retries, duplicates, background work, error handling.
• Maintainability: tests, duplication, dependencies.

How does a code audit of a Lovable and Supabase app work?

Start with the automated checks, then read the code by hand. Lovable's quick scan reviews the database, dependencies and MCP servers on every publish, and its deep scan looks at access control, secrets and authentication. Lovable itself says these tools cannot guarantee complete security, so apps handling sensitive data may need a professional review.

1. 01Run the tools firstLovable's scans, a dependency audit and our exposed key checker catch known patterns quickly, so human time goes to judgment.
2. 02Map who can reach whatList every table and server function, and check each against the rules the product needs. Missing row-level security shows up here.
3. 03Read the risky pathsSign-in, payments, file uploads and anything that sends email or changes another user's data.
4. 04Rank the findingsWrite each one down with what could happen, how likely it is, and the fix.

Which OWASP risks does a code audit look for beyond access control?

The OWASP Top 10:2025 gives an audit its checklist. After broken access control come security misconfiguration, software supply chain failures, cryptographic failures and injection. The list also covers insecure design, authentication failures, data integrity failures, logging and alerting failures, and mishandling of exceptional conditions such as errors and retries.

An audit tells you what is wrong; it does not fix it. If you want both, our vibe coding rescue starts with a review of what exists, then makes the fixes. For a quick first look before that, try the production readiness check.