Lovable's scan finds issues and publish still continues

Symptom

The publish dialog reports critical findings. The app goes live anyway, because blocking publish is a workspace setting and it is off.

Root cause

Lovable's publish docs say the dialog runs a Quick scan of database access rules, dependencies, and MCP server exposure. Findings do not block publishing by default. Workspace admins can turn on Block publishing with critical issues under Workspace settings, Security, Privacy and security. New Enterprise workspaces start with that block enabled. The security overview says the scans help identify common issues and cannot guarantee complete security, and that you are responsible for the app, especially if it handles sensitive data. The Deep scan does not run automatically as you work, except when publishing an MCP integration that allows access without sign-in.

Do not publish yet.

Open the Security view and list every critical finding in plain language: what it is, which table or file it names, and the fix you will make. Then fix only those findings. Re-run the Quick scan. If this workspace should not ship with critical findings, tell me to enable Block publishing with critical issues. Do not mark findings resolved without changing the code or the policies.

Paste this into the coding tool that has your own project open.

2-minute self-check

These steps are for an app you own. Do not run them against someone else's project.

1. In your own Lovable project, open Publish and read the scan line. Click through to the Security view if it reports findings.
2. In Workspace settings, Security, see whether Block publishing with critical issues is on.
3. Run the Deep scan on your own project before you publish if the app stores personal data or takes payment.

Sources

• Lovable: Publish your project
• Lovable: Security overview