Lovable review

Lovable is an AI app builder that turns a chat description into a full-stack web app. New apps use TanStack Start, which renders pages on the server, and run on Lovable Cloud: a built-in backend with a database, sign-in, storage, edge functions and hosting, built on Supabase's open-source foundation ^3,13. It builds web apps only; for phones it suggests a progressive web app, or wrapping the site with a tool such as Capacitor ¹³.

Lovable raised $400 million at a $13.3 billion valuation in August 2026, in a round led by Menlo Ventures and the Scaleup Europe Fund ¹⁸. Its growth has come with steady security scrutiny: a disputed critical CVE over missing row-level security in generated apps in 2025 ^19,20, an exposed app showcased on its own Discover page in February 2026 ²¹, and chats on public projects left readable after a permissions change ²².

Plan mode drafts a change for 1 credit a message, and Build mode then explores the codebase, edits many files and watches build errors and test failures ^2,10. When you ask it to verify, or while it chases a bug, the agent drives a remote browser against the preview: it clicks, fills forms and reads console and network logs ⁹. Most verification tools run only when you ask ¹⁰. Every change creates a version you can restore, but a restore covers code only, not database data ⁶.

Publishing deploys a snapshot to a lovable.app address, or to a custom domain on paid plans ⁷. A Quick scan of database rules, dependencies and MCP exposure runs when you open the publish dialog, and a Deep scan reviews authorization, injection and payment logic ⁴. Drafts and the published app share one database, and edits in the Database view go straight to production ⁸. Built-in payments run on Stripe or Paddle with a test mode in the preview ¹¹; connectors cover tools such as Slack, HubSpot and Salesforce, and admins can add any REST API ¹².

Pro starts at $25 a month for 100 credits and Business at $50 a month for the same credits; both scale to 10,000 credits ($2,250 and $4,300 a month), and annual billing gives two months free ¹. Every plan, Free included, adds 5 daily build credits, 20 Cloud credits and 4 AI credits a month ¹. Build mode is usage-based: Lovable's own examples run from 0.50 credits for a button color change to 2.00 for a landing page with generated images ². Hosting, database and in-app AI draw on credits beyond the grants, with no published per-unit rate ². Top-ups cost $15 per 50 credits on Pro and $30 on Business, and unused monthly credits roll over for two months ². One builder who wants a custom domain pays $25 a month for Pro ¹.

Lovable holds SOC 2 Type II, ISO 27001:2022 and AIUC-1 certifications, but it is not HIPAA compliant and does not sign BAAs ¹³. From September 9, 2026, Lovable may train on Free and Pro content unless the user opts out; Business and Enterprise workspaces are excluded by default ¹⁵. SSO comes with Business, and SCIM, audit logs kept for 13 weeks and EU inference with Enterprise ^1,14. The publish-time scan flags tables without per-record access rules, the Deep scan reviews app code, and Enterprise can block publishing while critical findings stay open ⁴. Lovable says these tools do not guarantee security and recommends a professional review for apps that handle sensitive data ⁴.

Lovable rates 4.6 from 450 G2 reviews ²³, 4.7 from 209 Product Hunt reviews ²⁵ and 4.2 from 1,790 Trustpilot reviews, where complaints focus on credits running out and slow support ²⁴. It names Delivery Hero, eXp Realty, The Scion Group, Nursa, Sentry and ElevenLabs among its customers ¹⁷. Independent coverage has centred on security: a 2025 scan found 170 of 1,645 Lovable apps exposing user data ²⁰, The Register reported 18,697 user records exposed in one showcased app in February 2026 ²¹, and The Stack reported that Lovable accidentally re-opened chats on public projects ²².