GitHub secret scanning now catches Lovable and Supabase keys

GitHub secret scanning now detects API keys and tokens from Lovable, Supabase, and Pydantic. The October 5 changelog is short. The point is not. These are the keys that end up in repos built fast with AI app builders, by people who have never rotated a credential.

What actually happened

Per GitHub's changelog, five new secret types:

• Lovable Labs: lovable_api_key. Lovable joined GitHub's secret scanning partner program. When one of these keys shows up in a public repo, GitHub reports it to Lovable automatically.
• Supabase: supabase_oauth_access_token and supabase_scoped_personal_access_token.
• Pydantic: logfire_token and pydantic_ai_gateway_api_key.
• Where alerts fire. The four non-partner detectors raise alerts in both public and private repositories.

The changelog does not say whether push protection blocks these types yet, or whether GitHub checks if a found key is still valid. We would not assume either.

Why it matters for your business

Lovable, Supabase, and similar tools let a non-developer ship a working app in a weekend. Many of those apps get exported to GitHub. Keys get pasted into a config file "for now." That file gets committed. The repo goes public for a demo.

A Supabase personal access token is not a minor leak. Depending on its scope, it can reach your project, your database, and your customers' rows. The Supabase row-level security problem already showed how much of this data is exposed. Leaked tokens make it worse.

What we'd do this week:

1. Turn on secret scanning for every repo you own, private ones included. Check the Security tab for alerts, including old ones.
2. Rotate first, then clean history. Removing a key from the latest commit does nothing. It is still in Git history. Revoke it at the provider, issue a new one, then scrub.
3. Move keys to environment variables. In Vercel, Netlify, or Supabase's own settings. Not in .env files you commit.
4. Scope tokens down. A scoped token that can read one project does far less damage than a full-account token.

Sources: GitHub Changelog: Secret scanning adds detectors for Lovable, Supabase, and more.