It's a real pentest, not a scan. Aikido deploys AI agents against your live, running application, the same one your users access. They probe login flows, try to access data they shouldn't be able to reach, and attempt to chain smaller weaknesses into bigger breaches. You get findings with full reproduction steps, not just a list of potential issues. Lovable's built-in scanner reviews your code before you publish. Aikido attacks what's actually running after you do.

Quite a lot! Most vulnerabilities in Lovable apps aren't in the code itself. They're in how the application behaves at runtime. Can a logged-in user access another user's data by changing a parameter? Does your API enforce the same rules your UI does? Are your authentication flows as airtight as they look? The pentest tests the running application, not the source code, which is exactly why it catches things a code review misses.

The agents interact with your app the way any user would, through its front end and APIs. One thing worth knowing: because the agents actively probe your app, they may create test data in the process (submitted forms, created accounts, and so on). They don't access your database directly. Findings are stored in your Aikido account and visible only to you.

They cover different moments and different threat models. Lovable's scanner reviews your code before you publish. It catches exposed secrets, misconfigured database policies, and known vulnerability patterns at the source level. Aikido tests your live application after it's running, probing how it actually behaves under attack, not just how it looks on paper. You need both. Code that looks clean can still have logic flaws that only show up when someone tries to break in.

No. Each finding comes with a plain-language explanation of what was found, why it matters, and the exact steps to reproduce it. When you're ready to fix, click Fix all in Lovable and their agent patches the vulnerabilities for you, without leaving your project.