The finding that 93 percent of the live Lovable apps send no Content-Security-Policy, and that apps on the same host share the same gaps, says a lot. It suggests the problem is defaults rather than careless builders, which also means one header rule at the host fixes most of it.

The crawler point surprised me more. If 76 percent of those apps send an almost empty HTML page, a founder may be doing everything right on the product and still be invisible to search and to AI assistants, with no error to tell them.

What I would add for anyone reading this before launch: write the four checks down as part of the definition of done for the release, next to the features, so they belong to what launched means rather than a later clean-up task. The two exposed service-role keys show why. Did the apps that scored well tend to have someone technical reviewing before launch, or was hosting the main difference?