Aikido

What is Aikido?

Aikido provides penetration testing for live applications built and deployed from Lovable. Inside Lovable, it runs a security test against your running app to simulate real attacker behavior and identify issues that may not be visible from code review or static scanning alone.

Its core purpose is to help builders validate security posture under real conditions—testing how endpoints behave with unexpected input, whether access controls hold across user flows, and whether chained weaknesses become exploitable—then return actionable findings the team can reproduce and fix.

Key Features

• Agent-based penetration testing against your live Lovable app: Aikido deploys a swarm of specialized agents that probe and test the application as it runs.
• Realistic attack simulation: Agents attempt actions like probing login, trying to access other users’ data, testing APIs, and adapting based on how the app responds.
• Chained multi-step exploit reasoning: The agents reason about application behavior and look for multi-step attack paths rather than only single-issue misconfigurations.
• Exploitation-validated findings: The test includes validation through real exploitation to distinguish what is actually exploitable.
• Plain-language results with reproduction and fix steps: Findings are explained in clear language and include step-by-step instructions to reproduce and remediate issues.
• One-click remediation from Lovable: After reviewing findings, Lovable offers a “Try Fix All” button to apply fixes, with the agent handling the work.

How to Use Aikido

1. Open your Lovable project and enable Aikido via Settings > Connectors > Shared Connectors.
2. Go to the project security tab and launch a pentest.
3. Log in to Aikido using your Aikido account details and start the security test.
4. Monitor the test in real time (including agent activity such as POC/exploitation behavior and reasoning, as shown in Lovable/Aikido).
5. Review pentest findings in Aikido or directly in Lovable.
6. Fix and publish using Lovable’s “Try Fix All” option, then publish with updated security.

Use Cases

• Before shipping a Lovable app: Use Aikido to test the running application end-to-end (login, endpoints, and API behavior) to catch issues that static checks may not reveal.
• Validating access control across user flows: Run a pentest to see whether permissions and access controls remain consistent when agents try to reach other users’ data through realistic interaction patterns.
• Assessing input handling at the endpoint level: Identify exploitable behaviors triggered by unexpected inputs and understand how the application responds under hostile attempts.
• Turning security reviews into actionable fixes: Convert findings into step-by-step reproduction and remediation guidance, then use Lovable’s one-click fix flow to apply changes.
• Answering security questionnaires during early growth: Use the resulting pentest report as evidence that can be shared during due diligence or enterprise security review processes.

FAQ

Where does Aikido run the pentest?

Aikido runs against your live application from within Lovable, deploying agents to test the app under real running conditions.

How is Aikido different from Lovable’s Security Scanner?

Lovable’s Security Scanner catches issues like exposed secrets, misconfigured database policies, and common vulnerabilities before publish. Aikido is complementary because it tests the live, running app to show what a hacker can actually do through chained, multi-step behavior.

What do you get after the test finishes?

You receive a report where each finding is explained in plain language, including why it matters and step-by-step instructions to reproduce and fix the issue.

Can fixes be applied without manual patching?

The page describes using Lovable’s “Try Fix All” button, after which the agent performs the fix work and you can then publish.

Do I need to enable anything in Lovable first?

Yes. You must enable Aikido in Lovable under Settings > Connectors > Shared Connectors, then use the project’s security tab to launch the pentest.

Alternatives

• Automated vulnerability scanning (static/CI security scanners): These focus on code, configuration, or known vulnerability patterns, and typically don’t validate exploitability against the running app the way a live pentest does.
• Manual or consultant-led penetration testing: Traditional pentesting is performed by security professionals and may require more time and planning; the workflow differs from agent-based testing inside Lovable.
• Continuous security testing and monitoring: Instead of a dedicated pentest session, this approach emphasizes ongoing detection and runtime signals, which can complement but doesn’t replace the need to test real exploitation paths during release readiness.
• Threat modeling and code review security practices: These help identify risks earlier in development, but they don’t necessarily replicate attacker behavior against a running system under realistic conditions.