Moving a Lovable app to production in 2027

Contents

1. What changes when real data arrives
2. Step 1: put the code where you control it
3. Step 2: review every data rule
4. Step 3: decide where the backend lives
5. Step 4: choose a route
6. Step 5: separate test data from live data
7. Step 6: name who maintains it
8. What success looks like
9. Questions buyers ask
10. Sources

A Lovable prototype proves that an idea works. Production means something narrower and more demanding: real people's data, access rules that hold, a backend whose location is known, and someone responsible when it breaks. This guide sets out the steps in the order that limits risk.

What changes when real data arrives

The reports that shaped Lovable's reputation share a pattern. In 2025 a researcher found 170 showcased projects whose database endpoints exposed data because row-level security was missing or inadequate⁠1Statement on CVE-2025-48757Matt Palmer · 29 May 2025. In 2026 another found that an exam app built on Lovable exposed 18,697 user records through missing row-level security and sign-in logic that blocked the people it should allow and allowed the people it should block⁠2Lovable-hosted app littered with basic flaws exposed 18K users, researcher claimsThe Register · 27 Feb 2026. In both cases the app worked. It simply let the wrong people in.

That is not specific to one builder. Veracode reports that 45% of code samples written by more than 100 AI models failed its security tests⁠3We asked 100+ AI models to write code. Here’s how many failed security testsVeracode · 30 Jul 2025. The gap between a working app and a safe one is the main thing a production step has to close.

Step 1: put the code where you control it

Connect the project to GitHub before anything else. Lovable's sync is two-way, available on every plan, and its documentation lists cloning to your own editor and deploying outside Lovable as intended uses; the code can also be downloaded without GitHub⁠4Sync your Lovable project with GitHubLovable Docs. Two details matter: the sync always creates a new repository rather than connecting to an existing one, and it works on one branch at a time⁠4Sync your Lovable project with GitHubLovable Docs.

Check which stack the app uses. Since May 13, 2026, new Lovable projects use TanStack Start, which renders pages on the server; older projects use React and Vite and render in the browser⁠56FAQLovable DocsUpgrade a project to TanStack StartLovable Docs. The difference affects which hosts can run the app.

Step 2: review every data rule

Lovable apps store data in Supabase-based Postgres⁠7Built-in backendLovable Docs, where access is controlled by row-level security. Supabase's guidance is to enable it on every table in an exposed schema; once enabled, no data is accessible through the API with a publishable key until policies grant it⁠8Row Level SecuritySupabase Docs.

A data-rule review before launch

• Every table that the app reads from the browser has row-level security enabled.
• Every policy has been read by a person, not only generated, and matches who should see which rows.
• Sign-in logic has been tested with a second account that should not see the first account's data.
• No API keys or secrets are present in the front-end code.
• Lovable's deep scan has been run, and its findings fixed or consciously accepted.

Lovable's own tools help with this. A quick scan runs when the publish dialog opens and checks for tables without row-level security, permissive policies, critical npm vulnerabilities and other issues; a deeper scan covers access control, abusable endpoints, injection, leaked secrets, payments and personal data⁠9Security overviewLovable Docs. Its documentation is clear that these scans cannot guarantee complete security⁠9Security overviewLovable Docs.

Step 3: decide where the backend lives

Lovable's built-in backend includes a database, storage, authentication, realtime and functions, and its region is fixed once enabled⁠7Built-in backendLovable Docs. A project can instead connect to the customer's own Supabase project. Moving from the built-in backend to your own Supabase later is manual: export and restore the database and storage, then reconfigure sign-in and secrets⁠7Built-in backendLovable Docs. If the app will hold regulated or long-lived data, it is cheaper to make this decision before launch than after.

Step 4: choose a route

There are three established routes, and the right one depends on what the app is.

Step 5: separate test data from live data

Production data should never be the place where an AI agent experiments. In July 2025 Replit's agent deleted a company's live database during a code freeze; Replit's chief executive called it unacceptable, and the company announced automatic separation of development and production databases and a planning-only mode⁠16An AI-powered coding tool wiped out a software company’s database, then apologized for a “catastrophic failure on my part”Fortune · 23 Jul 2025. Replit's Pro plan now includes database rollback of up to 28 days⁠17Pricing and plansReplit. Whatever the platform, keep a separate test database, take backups on a schedule and confirm that a restore works.

Step 6: name who maintains it

The last step is organisational. Someone has to apply security fixes, review new tables and policies, watch the bill and answer when a user reports a problem. On a self-serve builder that is the person who built it. Some platforms include it: OpenLazarus, for example, publishes managed hosting from $150 a month with backups, updates and monitoring, and developer support from $4,500 a month with ten engineering credits for fixes, features and integrations⁠18PricingOpenLazarus.

What success looks like

A production app has a short, checkable description. Its code is in a repository the company owns. Every table has row-level security and a reviewed policy. The backend's region and backup schedule are known, and a restore has been tested. Test and live data are separate. A named person or partner maintains it, with a budget. When all of those are true, the choice of builder matters much less than it did at the prototype stage. The main guide compares where each alternative fits.

Questions buyers ask

Sources

1. Statement on CVE-2025-48757. Matt Palmer, 29 May 2025. Accessed 8 Nov 2026.
2. Lovable-hosted app littered with basic flaws exposed 18K users, researcher claims. The Register, 27 Feb 2026. Accessed 8 Nov 2026.
3. We asked 100+ AI models to write code. Here’s how many failed security tests. Veracode, 30 Jul 2025. Accessed 8 Nov 2026.
4. Sync your Lovable project with GitHub. Lovable Docs. Accessed 8 Nov 2026.
5. FAQ. Lovable Docs. Accessed 8 Nov 2026.
6. Upgrade a project to TanStack Start. Lovable Docs. Accessed 8 Nov 2026.
7. Built-in backend. Lovable Docs. Accessed 8 Nov 2026.
8. Row Level Security. Supabase Docs. Accessed 8 Nov 2026.
9. Security overview. Lovable Docs. Accessed 8 Nov 2026.
10. Subscription plans. Lovable Docs. Accessed 8 Nov 2026.
11. Contribute to a GitHub project. Replit Docs. Accessed 8 Nov 2026.
12. GitHub. v0 Docs. Accessed 8 Nov 2026.
13. Build an app by describing it. FlutterFlow. Accessed 8 Nov 2026.
14. Native mobile app. Bubble Manual. Accessed 8 Nov 2026.
15. Design an operating system for your business with AI. OpenLazarus. Accessed 8 Nov 2026.
16. An AI-powered coding tool wiped out a software company’s database, then apologized for a “catastrophic failure on my part”. Fortune, 23 Jul 2025. Accessed 8 Nov 2026.
17. Pricing and plans. Replit. Accessed 8 Nov 2026.
18. Pricing. OpenLazarus. Accessed 8 Nov 2026.

Updated 8 Nov 2026: First published.

Further reading

• Buyer's guide · Updated quarterlyThe best Lovable alternatives for 2027An analysis of eight builders for people whose Lovable prototype now has to hold real data, compared on seven published criteria, with the evidence behind each and the established path to production.
• Guide · Reasons to switchWhy people leave Lovable in 2027, and when they shouldn'tCost per change, a record of security incidents and a backend built for speed rather than portability. What each reason rests on, how much weight it deserves and what to check before leaving.
• Guide · CostLovable vs Bolt vs Replit, what each costs in 2027All three start between $20 and $25 a month. They meter different things, and that difference decides what a busy month costs once a project grows.