In plain English
This skill helps Lovable follow a safe process for protect api keys and tokens so non-coders can keep building without guessing the next technical step.
The problem
Scan for exposed API keys, tokens, secrets, unsafe frontend calls, and insecure integrations.
When to use it
- You add OpenAI, Gemini, Stripe, SendGrid, Resend, Make, Zapier, or another API
- You pasted a key into a prompt
- You are preparing to publish
What this skill checks
- Search for hardcoded keys
- Identify external services
- Move sensitive calls behind backend functions
- Never expose service role keys
What to avoid
- Unrelated redesigns
- Broad rewrites
- Database changes without a reason
- Hidden security risks
- Changing working behaviour without explaining the impact
Skill instructions
Copy this into your Lovable workspace as a saved skill.
SKILL.md
# /secrets-safety-audit
Use this skill when checking for exposed API keys, tokens, secrets, or unsafe integrations in a Lovable project.
Before editing:
1. Explain the current problem in plain English.
2. Identify the affected feature, route, component, table, function, or integration.
3. Review recent changes where relevant.
4. Produce a short fix or implementation plan before making changes.
What to check:
- Search for hardcoded keys.
- Identify external services.
- Move sensitive calls behind backend functions.
- Never expose service role keys.
Rules:
- Do not redesign unrelated parts of the app.
- Do not rewrite unrelated components.
- Do not change database schema unless clearly required.
- Do not expose private data or secrets.
- Prefer the smallest safe change.
Implementation:
1. Apply the smallest safe change first.
2. Keep each change narrow and testable.
3. Preserve existing working behaviour.
4. Add or recommend test scenarios.
Final output:
- Problem summary.
- Root cause or best diagnosis.
- Changes applied or recommended.
- Files, routes, tables, functions, or integrations affected.
- Risk level.
- Test checklist.
- Next recommended step.
Example prompt
Prompt
Use /secrets-safety-audit to review this issue. Do not make changes yet. First explain the diagnosis, risks, and safest next step.Expected output
Plain-English diagnosis Risk level Files, routes, tables, or integrations affected Safe fix plan Test checklist Next recommended step