Open
Conversation
- Add lovable SDK provider with apps and published services - Add 12 security checks mapped to Lovable security best practices - Add Prowler ThreatScore for Lovable compliance framework - Add API support: provider type, secret schema, UID validator, migration - Add UI support: provider choice, credentials form, badges, wiring - Add SDK tests for provider, services, and critical checks
github-actions
Bot
added
compliance
Contributor
Compliance Mapping ReviewThis PR adds new checks. Please verify that they have been mapped to the relevant compliance framework requirements. New checks already mapped in this PR
Use the |
Contributor
|
✅ All necessary |
Contributor
|
✅ Conflict Markers Resolved All conflict markers have been successfully resolved in this pull request. |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
Comment on lines
+9
to
+13
| def is_finding_muted( | ||
| self, | ||
| finding: CheckReportLovable, | ||
| workspace_id: str, | ||
| ) -> bool: |
Contributor
🔒 Container Security ScanImage: 📊 Vulnerability Summary
2 package(s) affected
|
Contributor
🔒 Container Security ScanImage: 📊 Vulnerability Summary
4 package(s) affected
|
Contributor
🔒 Container Security ScanImage: 📊 Vulnerability Summary
8 package(s) affected
|
Codecov Report❌ Patch coverage is Additional details and impacted files@@ Coverage Diff @@
## master #11092 +/- ##
==========================================
- Coverage 94.52% 93.63% -0.90%
==========================================
Files 47 231 +184
Lines 1315 33964 +32649
==========================================
+ Hits 1243 31801 +30558
- Misses 72 2163 +2091
Flags with carried forward coverage won't be shown. Click here to find out more.
🚀 New features to boost your workflow:
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Context
Lovable apps (AI-generated web apps) ship with a well-known set of security pitfalls — missing Supabase RLS, secrets bundled into the frontend, missing auth on Edge Functions, missing security headers — most of which are documented in the official Lovable security best practices and reinforced by independent reviews like meetcyber.net's 2026 Lovable best practices.
This PR adds first-class support for Lovable across the SDK, API, and UI so Prowler users can assess their published Lovable workspaces with the same tooling they already use for AWS, Azure, and the rest. CIS does not publish a Lovable benchmark, so the PR includes a Prowler ThreatScore for Lovable framework instead.
Description
SDK / CLI (
prowler lovable …)lovableprovider modelled on the Vercel pattern: API-token auth, optional Supabase Management token for deeper RLS / Edge-Function checks, optional--projectand--published-app-urlscope filtersapps— Lovable Cloud project metadata (visibility, auth posture, Supabase backing)published— live HTTP fetch of the published app for security-header and frontend-secret-scan checksCheckReportLovable, factory dispatch, parser banner, and outputs wiring--lovable-api-token,--supabase-access-token) registered inSENSITIVE_ARGUMENTSfor redaction; environment variables (LOVABLE_API_TOKEN,LOVABLE_WORKSPACE_ID,SUPABASE_ACCESS_TOKEN) are the recommended pathCompliance
prowler/compliance/lovable/prowler_threatscore_lovable.json) with 12 requirements across Identity & Access Management, Attack Surface, and Secrets Management pillarsAPI
Provider.ProviderChoices.LOVABLE,validate_lovable_uidvalidator,LovableProviderSecret(requiredapi_tokenplus optionalsupabase_access_token), connection-test wiring, migration0091_lovable_provider, and aLovable API Tokenentry in the provider-secret OpenAPI schemaUI
LovableCredentialsForm, workspace UID input, credential field constants, secret builder, default-values hook, findings/overview integration, Lovable docs link in the provider help panelSteps to review
The provider registers under existing factories without touching unrelated providers; reviewers can scan the per-component changelog entries (
prowler/CHANGELOG.md,api/CHANGELOG.md,ui/CHANGELOG.md) for a quick summary.Checklist
Community Checklist
lovableprovider.SDK/CLI
UI (if applicable)
API (if applicable)
api/src/backend/api/specs/v1.yamlshould be regenerated to includelovablein the provider enum (left to the maintainer's spec-regeneration step).License
By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.