carlos / platform Public

Lovable shows a security scan in its publish dialog. carlos vet already reads a release before it ships and could run cheap, high-signal checks:

• a known-vulnerable dependency (for Go, govulncheck against the binary's embedded module list);
• a secret-shaped string in the binary;
• whether the process sets the platform's baseline headers on a representative route.

It would report rather than refuse. Worth keeping in mind what went wrong with the scan it's modelled on: it checked that a row-level-security policy existed, not that it worked. A shallow check that reads as coverage is worse than none, so the report should say what each check can't see.

--- Filed from the ips repository (Turnkey's insolvency practice system, built on rastrillo v0.26.0 and deployed on CARLOS), where this was worked around. Paths without a repository prefix are in ips.