Lovable, the reference point: what it does well and where it stops

Contents

1. What Lovable does
2. Security
3. Published evidence
4. Strengths and limits
5. Pricing
6. When to stay, and when to look elsewhere
7. Sources

Type	AI app builder (reference)
Headquarters	Stockholm, Sweden
Founded	2023
Pricing	Published
Website	lovable.dev

Lovable is profiled here as the reference point, not ranked. Everything below comes from Lovable's own pages, except where independent reporting is named. This site is independent of Lovable and uses its name only to identify the product.

Best for: Polished web apps built quickly from chat, whose code the team wants to keep, by someone able to review the database access rules before real data arrives.

Not the right fit for: Native mobile apps, HIPAA workloads, or teams with no one to own security and maintenance after launch.

What Lovable does

Lovable builds web apps from chat. Its built-in backend, built on Supabase's foundation, includes a database, storage, authentication, realtime and functions, with jobs, secrets and logs; a project can use the customer's own Supabase project instead⁠1Built-in backendLovable Docs. New projects have used TanStack Start, which renders pages on the server, since May 2026; older ones use React and Vite⁠23FAQLovable DocsUpgrade a project to TanStack StartLovable Docs.

The code belongs to the customer. Every plan, including Free, can sync two ways with GitHub, and the code can be downloaded or deployed outside Lovable⁠4Sync your Lovable project with GitHubLovable Docs. Workspaces have unlimited members and are priced by credits rather than seats⁠5Subscription plansLovable Docs. The company was founded in Stockholm in 2023⁠6Lovable (company)Wikipedia, and in August 2026 it reported more than 60 million projects built on the platform⁠7Series C announcementLovable · 12 Aug 2026.

Security

Before publishing, a quick scan checks for tables without row-level security, permissive policies and other common issues; a deeper scan covers access control, injection, leaked secrets, payments and personal data. Lovable's documentation states that users are responsible for their app's security and that its tools cannot guarantee complete security⁠8Security overviewLovable Docs. It states SOC 2 Type II, ISO 27001:2022 and AIUC-1 certifications, and says it is not HIPAA-compliant⁠2FAQLovable Docs.

Its record includes the disputed 2025 vulnerability CVE-2025-48757 about apps with inadequate row-level security⁠9CVE-2025-48757MITRE CVE Program · 30 May 2025, and an April 2026 incident in which, by Lovable's own account, public projects' chat history and source code were viewable by any Lovable user with a link for about eleven weeks; private projects and its built-in backend were not affected⁠10Our response to the April 2026 incidentLovable · 22 Apr 2026. The guide to why people leave Lovable sets these out in full.

Published evidence

No case studies with named customers are published.

Strengths and limits

Strengths

• The code is the customer’s: GitHub sync on every plan, plus a code download, and the option to deploy outside Lovable.
• Security scanning is part of publishing: a quick scan checks for tables without row-level security and permissive policies, and a deeper scan can be run on demand.
• Workspaces have unlimited members on every plan, so cost follows credits rather than seats.
• Lovable states SOC 2 Type II, ISO 27001:2022 and AIUC-1 certifications.

Limits

• Credits are spent per change, and the backend and in-app AI draw on the same balance, so the monthly cost depends on how the app is built and used.
• Its documentation says users are responsible for their app’s security and that its tools cannot guarantee complete security.
• Does not build native mobile apps; its FAQ suggests a progressive web app instead.
• The backend region is locked once enabled, and moving out to your own Supabase project is a manual export and restore.

Choose another option if: You need native mobile apps, a system someone else maintains, or a database you can move without a manual migration.

Pricing

Published: Free with 5 daily credits (up to 30 a month); Pro from $25 a month and Business from $50 a month for 100 credits, scaling to 10,000 credits. Enterprise on request.

When to stay, and when to look elsewhere

Lovable remains a good fit for a web product built by someone who can review data access rules and accepts credit-based billing. Teams usually look elsewhere for native mobile apps (FlutterFlow, Bubble), for more control over code and spending (Replit, v0), or for a company system that someone else maintains (OpenLazarus). The main guide compares them.

Sources

1. Built-in backend. Lovable Docs. Accessed 8 Nov 2026.
2. FAQ. Lovable Docs. Accessed 8 Nov 2026.
3. Upgrade a project to TanStack Start. Lovable Docs. Accessed 8 Nov 2026.
4. Sync your Lovable project with GitHub. Lovable Docs. Accessed 8 Nov 2026.
5. Subscription plans. Lovable Docs. Accessed 8 Nov 2026.
6. Lovable (company). Wikipedia. Accessed 8 Nov 2026.
7. Series C announcement. Lovable, 12 Aug 2026. Accessed 8 Nov 2026.
8. Security overview. Lovable Docs. Accessed 8 Nov 2026.
9. CVE-2025-48757. MITRE CVE Program, 30 May 2025. Accessed 8 Nov 2026.
10. Our response to the April 2026 incident. Lovable, 22 Apr 2026. Accessed 8 Nov 2026.
11. Credits and usage. Lovable Docs. Accessed 8 Nov 2026.
12. Lovable Pricing. Lovable. Accessed 8 Nov 2026.
13. Security at Lovable. Lovable. Accessed 8 Nov 2026.

Further reading

• Buyer's guide · Updated quarterlyThe best Lovable alternatives for 2027An analysis of eight builders for people whose Lovable prototype now has to hold real data, compared on seven published criteria, with the evidence behind each and the established path to production.
• Guide · Reasons to switchWhy people leave Lovable in 2027, and when they shouldn'tCost per change, a record of security incidents and a backend built for speed rather than portability. What each reason rests on, how much weight it deserves and what to check before leaving.
• Guide · CostLovable vs Bolt vs Replit, what each costs in 2027All three start between $20 and $25 a month. They meter different things, and that difference decides what a busy month costs once a project grows.