Lovable, from Stockholm, is an AI platform that builds and hosts web apps from plain-English instructions. It launched in November 2024, and many of its users aren’t technical.
By default, your code, hosting and data all sit on Lovable. New apps have a built-in backend based on Supabase, though some apps connect to a Supabase project of their own. The two work differently, so it’s worth knowing which yours is. We aren’t connected with Lovable, and everything below comes from its public documentation and published reporting, as we read them on 6 November 2026.
What Lovable says is your job
Lovable provides real security tools. A Quick scan runs each time you publish, and a Deep scan reviews your code when you ask for it. It also keeps secret keys out of the browser, and it sets up database rules when it builds features that store user data. Then it’s straightforward about the limits. Its documentation says:
It goes on: “These tools help identify common security issues, but they cannot guarantee complete security. For apps handling sensitive data or critical functionality, consider an additional professional security review.”
That’s a sensible position. A scanner can look for known patterns, but it can’t know that a discount is confidential, or that a driver shouldn’t see another depot’s customers. Two details are worth knowing: the Deep scan doesn’t run automatically as you work, and only dependency issues rated critical become findings.
Who holds the keys
This is where a business needs to look hardest. Each Lovable workspace has a primary owner, used for billing and domain claims. Each project has one owner too.
- Only the current primary owner can transfer primary ownership. All plans include the option, but it needs that person’s login.
- We found no documented route for an owner who has gone. We searched the documentation for what happens if the owner has left, and found no process. Only Lovable’s support could tell you for certain. Its form needs a login on a paid workspace, and if you can’t log in, it says to email from the same account email, which is no help if that mailbox has gone with them.
- A lost two-step sign-in does have a route. Lovable doesn’t provide backup codes, so you try your other sign-in method, and then contact support with proof of ownership, such as the account email, recent project IDs and billing details. Keep those somewhere the business can find them.
- Deleting the account deletes the workspace. If a sole owner deletes their account without handing over, Lovable says the workspace and all the projects in it go too, after a 30-day grace period.
- Restricted projects don’t move automatically. When someone leaves, their projects normally pass to the most senior remaining member, but Restricted projects stay in the name of the person removed until an owner moves them.
- Warnings go to owners and admins. A database can pause if the workspace runs out of credits. If the only owner’s inbox isn’t being watched, you may find out when it stops.
Happily, adding people doesn’t put up your subscription, as plans are priced by credits and not by seats. So cost is no reason to run with one person. Why this matters to the business.
Getting your things out
Lovable’s terms say you own what you build, and you aren’t locked in. In practice, moving is real work, and Lovable says so: “Moving a backend is developer work.”
- Code: sync it to GitHub, GitLab or Bitbucket on any plan, or download a zip on a paid plan. Neither includes your data.
- Data: exported separately, under More, Database, Manage, Settings. Files in storage and secret keys aren’t in that export.
- Backups: daily, kept for roughly 14 days. Anyone with edit access can restore one, and restoring can’t be undone.
It’s worth taking a copy now and keeping it somewhere the business controls.
What has gone wrong publicly
These events are matters of public record, some of them disputed. We describe them because you’re entitled to know, not because Lovable is unusually careless. Every platform in this market is moving very fast.
- Database rules, 2025. Researcher Matt Palmer scanned apps from Lovable’s showcase and reported 170 of 1,645 projects with inadequate database rules, looking at homepages only. It was recorded as CVE-2025-48757. Lovable disputes the record, on the basis that each customer is responsible for protecting their application’s data.
- One showcased app, February 2026. The Register reported a researcher’s finding of 16 flaws in a single app, with 18,697 user records exposed. Lovable said the project included code it hadn’t generated and that the vulnerable database wasn’t hosted by Lovable. The two sides differ on how the report was handled.
- Public projects, February to April 2026. Lovable acknowledged that between 3 February and 20 April 2026, public project chats and source code could be reached by any Lovable user with a project link, after a permissions change. It says private projects and its Cloud backend were never affected, and that it shipped a fix within two hours. The researcher claimed a wider scope, and that remains disputed. You can no longer create public projects.
- New research, November 2026. Sifted reported on 3 November that thousands of Lovable-built apps exposed sensitive user data, according to new research. The full article is paywalled, so we haven’t been able to assess its method.
You’ll see percentages quoted for “how many Lovable apps are insecure”, ranging from about 7% to about 70%. They measure different things, some come from firms selling scanners, and we wouldn’t rely on any of them. What matters is whether your app is safe, and only looking will tell you that.
What you can check today
These are the menu names in Lovable’s documentation, which can change.
Who’s the owner?
Workspace settings, then People. The primary owner shows as Owner*. Is it a person or the business? Is it a personal email?
Is two-step sign-in on?
Account settings, then Security, then Two-factor authentication. Check it for every owner. There are no backup codes, and Lovable recommends setting up both an authenticator app and a phone.
Have the scans been run?
More, then Security. Are the Quick and Deep scans up to date? Are there any Critical or ignored findings?
What do the database rules say?
More, Database, Manage, then Policies. Look at “Applies to” for anon, which means anyone not signed in.
Who can see the live app?
The Publish dialog. By default, anyone with the link can visit.
Is remixing off?
Project settings, Sharing, Public remixing. When it’s on, people can view your source code in their copy. For a business app, you’ll normally want it off.
Are there backups, and a copy of your own?
More, Database, Manage, Backups, and then Export project data under Settings.
For the wider picture, try our 10 checks as well.
How we can help
Our audit does what a scanner can’t: it works out who should see what in your business, tests whether they can see more than that from outside the app, and looks at everything around Lovable too, such as spreadsheets, connectors and logins. Then we set it all out in plain English. See an example.
Questions
Is Lovable safe to use for a business?
It can be. Lovable says it holds SOC 2 Type 2 and ISO 27001 certifications for the platform, but your app’s own rules and settings are your responsibility. The right question is whether your particular app is safe, which depends on how it was built and configured.
Is my app on Lovable’s backend or my own Supabase?
Look in Settings, General, External Supabase. It matters because it changes who controls the database and who can reach it, and Lovable’s automatic password rotation only covers the built-in one.
Where is my data stored?
Lovable offers regions for the Americas, Europe and Asia Pacific, and the region can’t be changed once the backend is enabled. The setting covers stored data, not where AI requests are processed. Check what yours is, as it affects what your privacy notice should say.
Sources
By Selwyn Doling, VibeTend. Last updated 6 November 2026.
