Cloud · News
GitHub Now Scans Lovable and Supabase Keys
lovable_api_key is a partner secret. Logfire and Pydantic AI Gateway keys, plus two Supabase tokens, join the detector list. Public repos get the phone-home.
Alex Rivera · Oct 5, 2026 · Updated Oct 7, 2026 · 8 min read
The AI app builders finally got a leak detector that knows their key shapes.
On 5 October 2026 GitHub secret scanning added Lovable Labs, Pydantic Services, and more of Supabase. Lovable joined the partner program: if a lovable_api_key hits a public repository, GitHub forwards it so Lovable can revoke it. User-class secrets still alert in public and private repos without phoning the issuer. New detectors: lovable_api_key, logfire_token, pydantic_ai_gateway_api_key, supabase_oauth_access_token, supabase_scoped_personal_access_token.
Image: GitHub Changelog, Secret scanning adds detectors for Lovable, Supabase, and more, 5 October 2026.
Why this showed up now
Lovable, Supabase, and Pydantic AI Gateway are how a lot of 2026 prototypes leave a laptop. Agents commit .env files with the same confidence they commit components. Partner forwarding is the only control that works when the author never enables scanning alerts. If you run a public template repo, assume a Lovable key will land in it and assume GitHub will tell Lovable before you will.
For private work, turn the new patterns on in the org's secret scanning settings and add them to push protection. The scoped Supabase PAT is the one people will paste into a coding agent because the docs said scoped. Scoped is not harmless. It is still a token. Treat pydantic_ai_gateway_api_key like an OpenAI key: it is a bill and a proxy into whatever the gateway can see.
Sources
GitHub Changelog, Secret scanning adds detectors for Lovable, Supabase, and more, 5 October 2026. https://github.blog/changelog/2026-10-05-secret-scanning-adds-detectors-for-lovable-supabase-and-more/