Skip to content

Sample repair plan. Anonymised Lovable app with Supabase, verdict Iterate, 8 findings in 6 fix units. Your plan looks just like this, with your locations.

Go to the decivo Scan

Repair plan

app.beispiel-kunde.de

  • RSC-2026-4222
  • Built with Lovable
  • Supabase
  • Outside scan and repository

Progress

0 of 6 units done

Tick a unit off as soon as it is deployed. The next rescan checks whether the fix holds.

fix units in the plan
6
stack targeted by the solutions
Lovable or Vite with Supabase

Order

Sorted by dependency and risk. One unit after the other, each with a check criterion.

  1. 01

    Remove and rotate secrets

    1 finding · Code indicators

    • Effort M
    • Risk low
    • Due within 4 weeks

    Findings and locations

    • LowSource maps publicRSC-COD-001

      vite.config.ts: build.sourcemap not turned off GET https://app.beispiel-kunde.de/assets/index-8f3a2c.js.map 200 OK, 1.4 MB

    Dependency

    First, because otherwise every further change ships with readable source or exposed keys.

    Solution for your stack (Lovable or Vite with Supabase)

    Turn off source maps in vite.config.ts and redeploy. Never use the service_role key in the frontend; rotate every key that appeared in the shipped code and update the variable in Lovable.

    // vite.config.ts
export default defineConfig({
  build: { sourcemap: false },
});

// Supabase: Settings → API → Schlüssel rotieren
// danach die Variable in Lovable aktualisieren

    Check criterion

    Requests for *.js.map, /.env, /.git/ and backups return 404. The old keys are rejected by the provider.

    Prompt for Lovable, Cursor or Claude Code

    Ready to paste, with the findings, locations and check criterion of this unit.

    You are working in my project (Lovable or Vite with Supabase). Fix exactly this fix unit: Remove and rotate secrets.

Findings from the decivo scan:
- Source maps public (RSC-COD-001)
  Location:
    vite.config.ts: build.sourcemap not turned off
    GET https://app.beispiel-kunde.de/assets/index-8f3a2c.js.map
    200 OK, 1.4 MB

Approach: Turn off source maps in vite.config.ts and redeploy. Never use the service_role key in the frontend; rotate every key that appeared in the shipped code and update the variable in Lovable.

Orientation (adapt it to the project, do not copy blindly):
// vite.config.ts
export default defineConfig({
  build: { sourcemap: false },
});

// Supabase: Settings → API → Schlüssel rotieren
// danach die Variable in Lovable aktualisieren

Done when: Requests for *.js.map, /.env, /.git/ and backups return 404. The old keys are rejected by the provider.

Do not change anything outside this unit. At the end, list the changed files and how I can verify the check criterion myself.
  2. 02

    Cookie consent and trackers

    1 finding · Law and privacy

    • Effort M
    • Risk high
    • Due this week
  3. 03

    Security headers

    2 findings · Security

    • Effort S
    • Risk medium
    • Due within 2 weeks
  4. 04

    Self-host fonts and third-party loaders

    1 finding · Law and privacy

    • Effort S
    • Risk medium
    • Due within 2 weeks
  5. 05

    Form accessibility

    1 finding · Accessibility

    • Effort M
    • Risk medium
    • Due within 2 weeks
  6. 06

    Mandatory pages

    1 finding · Law and privacy

    • Effort S
    • Risk low
    • Due within 4 weeks

Not in the plan: architecture findings (stabilisation)

„Role check inside the client bundle“ cannot be solved from the catalogue. A person names a price for it after the repository scan.

Go to the repair

You get your own plan from the report.

€349 net, one-off. First proof of ownership or a repository scan, then the order. We send the invoice separately and release the plan after our review.

Check your own app