Lovable: public signals observed without founder access.

Preliminary scan — not founder-verified

This profile uses only publicly reachable signals. It does not verify internal settings, source code, data handling, provider accounts, or founder declarations, and it does not qualify for the TrustData Verified badge.

Profile status: Preliminary
Last public scan: Aug 2, 2026
Credentials used: None

Public scan observations

Seven public checks, with explicit limitations.

“Not available” means the signal could not be proven from public access. It is never replaced by a guessed value and does not imply that the underlying practice is absent.

Check	Status	Public evidence	Observed
Homepage security headers	Fail	One or more requested security headers were absent from the homepage response. Content-Security-Policy: object-src 'none'; base-uri 'self'; script-src 'nonce-sIefKNuFhFfWRK0giNE4cg==' 'strict-dynamic' 'wasm-unsafe-eval' 'self' 'report-sample'; worker-src 'self' blob: Strict-Transport-Security: max-age=31536000; includeSubDomains X-Frame-Options: Not available Referrer-Policy: strict-origin-when-cross-origin	Aug 2, 2026
TLS certificate	Pass	The public TLS endpoint presented a current authorized certificate. Certificate issuer: Google Trust Services / WE1 Certificate expiration: 2026-09-02T20:24:30.000Z Negotiated TLS protocol: TLSv1.3 Certificate chain authorization: Authorized	Aug 2, 2026
Email DNS records	Pass	SPF, DMARC, and a public DKIM selector were observed. SPF record: v=spf1 a mx include:_spf.firebasemail.com include:50723964.spf07.hubspotemail.net ip4:209.85.220.41 ~all DMARC policy: quarantine Public DKIM selector: google: v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAulLj1s99iWfBqw+X6ojNBGfP2I6JPI0NhkXrQiar0uPdKaPt5bbKsJ38JgVX9pu2Rz7vcyTa4hxk8DBNbc84+399P5HN6dtxEMd9DW1M3zQbSR5U8LNs9gbv4CbPND+zdoUY/Wy06+Wnrlh1WyiVh3aNhDu7OFvQ1unu2gNavHvn7Nd6gc2FX+jBJBU9cfs0NYjQt8DyuLgi/yu4HOyxX8WHxVf0G3+mQkn6XUpyWr8XFGLmLNSF+CRVpX2MqYHqal8TFA3z6DdxEgcKRtUJeoyecAhf/tpj1gqHtyzPt13UE47Tz6iqbQ6UPFXs/NnYwMKJbjWDl6jqg+5WspcRwQIDAQAB	Aug 2, 2026
Conventional public files	Pass	All three conventional public files were reachable. security.txt: HTTP 200 — public source robots.txt: HTTP 200 — public source sitemap.xml: HTTP 200 — public source	Aug 2, 2026
Public GitHub repository	Not available	No attributable public GitHub organization repository was confirmed.Not finding a repository does not prove that the company has no public repository.	Aug 2, 2026
Client-visible trackers and cookies	Not available	No supported tracker signature was observed in the static homepage response. Homepage response cookies: USER_COUNTRY, USER_CURRENCY, LOCALE, rs_visitor_id, __cf_bm Trackers loaded dynamically after JavaScript execution are not observable by this public HTTP scan.	Aug 2, 2026
Privacy policy URL	Pass	A linked privacy policy URL was reachable. Privacy policy URL: HTTP 200 — public source Only the URL was checked; policy content was not downloaded or analyzed.	Aug 2, 2026

Are you the founder of Lovable? Claim this profile and start the full verification.

Full verification remains separate from this scan and starts with the existing founder flow.

Claim this profile