Lovable said its annualized revenue passed $600 million in September 2026, according to TechCrunch, a month after raising $400 million at a $13.3 billion valuation. It's the default answer when a non-developer asks how to build an app. It's also the builder with the longest public record of generated apps leaking data, which is why a review that only covers speed and pricing misses half the decision.
TL;DR
Users consistently rate Lovable one of the fastest ways to turn a prompt into a good-looking React app, and its two-way Git sync means the code is yours. It also has better built-in security tooling than its rivals: RLS on by default, a migration linter, and a Deep Scan. The catches are credits that drain on bigger projects, a Lovable Cloud backend that takes effort to leave, and an architecture where the browser talks straight to the database, so one weak policy exposes your users. Our rating: 3.3 out of 5. Great for MVPs; run the Deep Scan and check your RLS before real users arrive.
Our Verdict
Use with Caution| What we scored | Score | Why |
|---|---|---|
| Speed to a working app | 4/5 | The most consistent praise across Trustpilot, G2 and Product Hunt |
| Code ownership and exit | 3/5 | Excellent two-way Git sync, but leaving Lovable Cloud is a manual migration that doesn't carry storage files or secrets |
| Pricing predictability | 3/5 | Rollover, published per-task examples and spend caps, offset by persistent complaints about opaque credit use |
| Security defaults | 3/5 | Strongest tooling in its class, but a browser-to-database model and a history of real leaks |
| Overall | 3.3/5 |
What's Good
- Fast, polished React output with Tailwind and shadcn/ui
- Two-way sync with GitHub, GitLab and Bitbucket
- RLS on by default, a migration linter, and Quick and Deep security scans
- Secrets encrypted with Google Cloud KMS and kept out of the browser
- SOC 2 Type II and ISO 27001 certified
What to Watch
- Credits drain fast on large projects and fix loops
- No one-click exit from Lovable Cloud to your own Supabase
- The browser queries the database directly, so RLS is your only wall
- Free and Pro content is used for training unless you opt out
- A track record of public incidents, on apps and on the platform
How we reviewed this. We worked from Lovable's documentation, pricing, security and data-use pages, its funding announcements, public incident reports, and user reviews on Trustpilot, G2 and Product Hunt. We also drew on our own earlier research into Lovable, linked throughout, including tests against Lovable's demo app for our trust center analysis. We haven't yet published a timed build-and-scan of a fresh Lovable app; we'll add it here when we do. Lovable didn't sponsor or review this page.
What Lovable Actually Builds
Lovable writes a React frontend with Vite, TypeScript, Tailwind and shadcn/ui. For the backend you either use Lovable Cloud, launched in September 2025, which gives you Postgres, auth, storage, edge functions and an AI gateway with Supabase underneath, or you connect your own Supabase project.
Publishing is one click, with automatic SSL. Custom domains need a paid plan.
The important design choice is that there's usually no backend server of your own. The React app in the browser talks to the database directly with a public key, and Postgres row-level security decides what each user can see. That's what makes Lovable apps quick to build. It's also why their failures look the way they do.
Pricing and Credits
Here's what Lovable's docs list as of October 2026. Check before buying, since Lovable changed how billing works in June 2026.
| Plan | Monthly | Credits per month | Notes |
|---|---|---|---|
| Free | $0 | 5 a day, up to 30 | |
| Pro | from $25 | 100 (higher tiers available) | About $21/mo billed annually |
| Business | from $50 | 100 (higher tiers available) | SSO, governance, training opt-out by default |
| Enterprise | Custom | Custom |
Credits are charged by how much work a request takes. Lovable's own examples put a small styling change at half a credit and adding authentication at about 1.2 credits. Unused credits roll over while you're subscribed, with an expiry, and top-ups are available with an optional monthly spend cap.
Since June 2026, one credit balance covers both building and running your app on Lovable Cloud. That's simpler to understand, but it also means a busy app and a busy build session now draw from the same pot.
The complaint is the same everywhere. Trustpilot, G2 and Product Hunt reviewers all describe credits vanishing into fixes that don't fix anything, with the agent reporting success on a bug that's still there. Small apps rarely hit this. Larger ones hit it constantly. Turn on the spend cap if you enable auto top-up.
Code Ownership and Leaving
Lovable's Git integration is among the best in the category: two-way sync with GitHub, GitLab and Bitbucket, so edits made in your editor flow back into Lovable. You can deploy the frontend to Vercel, Netlify or your own server. (Lovable's GitHub docs say you can't import an existing repository, though; projects have to start in Lovable.)
The backend is the sticking point. According to Lovable's Cloud docs, there's no one-click migration from Lovable Cloud to your own Supabase project. The database export carries your schema, data and password hashes, but not storage files or secrets, and removing Cloud deletes the instance. If you think you'll outgrow Lovable, connecting your own Supabase project from day one is the cheaper exit.
Security: The Short Version
Our Lovable security assessment has the full list of failures and fixes. Here's what matters for a buying decision.
Lovable's tooling is ahead of its rivals. Lovable states that RLS is on by default and that a linter flags tables missing it after migrations. A Quick Scan runs at publish, and an on-demand Deep Scan reviews authorization, unauthenticated endpoints, injection and leaked secrets. Secrets are encrypted with Google Cloud KMS and injected server-side, and Lovable detects keys pasted into chat. It's also a GitHub secret scanning partner, so a leaked workspace key gets revoked within moments of being pushed to a public repo.
The architecture still puts everything on RLS. Because the browser queries the database directly, a policy is the only thing between an anonymous visitor and your tables. "RLS on" isn't the same as "RLS correct". A policy like USING (auth.uid() IS NOT NULL) passes every automated check and still hands every row to anyone who signs up. Our Lovable and Supabase blueprint shows how to spot it.
Lovable apps have leaked real data, more than once. In 2025, a researcher found 170 of 1,645 Lovable showcase apps with missing row-level security, which became CVE-2025-48757 (Lovable disputes that it's a platform flaw). In February 2026, a featured Lovable app with authentication logic written backwards exposed 18,697 user records, including students. In April 2026, a broken-authorization flaw in Lovable's own platform let logged-in users read the chat history of other people's public projects; Lovable made public projects private, and reports disagree on how far back the exposure reached.
Two more things to know:
- Training on your content is on by default for Free and Pro. From September 9, 2026, Lovable may use prompts, code and files from those plans for model training unless you opt out. Business and Enterprise are excluded by default, and your app's end-user data is excluded either way. Our opt-out guide shows where the toggle is.
- Your trust page is an allowlist, not an audit. Lovable's published trust page for your app lists only the checks it passes. Our trust center analysis explains how to read what's missing.
What Users Say
Lovable's public ratings vary a lot by site. Trustpilot reviewers are noticeably harsher than G2 and Product Hunt, and a large share of Trustpilot reviews are about billing rather than the product.
Praised: speed, ease of use, the quality of the generated UI, and the Supabase integration.
Complained about: opaque credit use, credits not appearing after purchase, bugs the agent claims to have fixed, trouble handling complex apps, and slow support.
As with Emergent, almost no user review mentions RLS, data exposure or secrets. Lovable's security incidents were found by researchers, not by the people building the apps.
Who Lovable Is For
A good fit if you want a polished MVP or internal tool quickly, you'll keep the project small or move it to your own repo when it grows, and you'll run the Deep Scan and read your RLS policies before launch.
A poor fit if your app will hold sensitive data and nobody will review the policies, you need predictable costs on a large codebase, or you want to keep your prompts out of training data without paying for Business.
Lovable Alternatives
The builders people compare with Lovable most often are Bolt.new, v0, Replit, Base44 and Emergent.
- Bolt.new is the closest match. Our Bolt vs Lovable comparison covers how their security defaults have diverged.
- v0 is stronger on frontend components and weaker as a full-stack builder. See Lovable vs v0.
- Emergent takes the opposite approach to the database, with a FastAPI backend in the middle and no RLS. Read our Emergent review for how that trade plays out.
Once a project outgrows any builder, Cursor or Claude Code on the synced repo is the usual next step.
Is Lovable worth it?
For getting a polished MVP in front of users quickly, yes. Users consistently rate Lovable among the fastest builders from prompt to working React app, and its Git sync means you aren't trapped. It's less worth it once the app grows: users consistently report credits disappearing into fix loops on larger projects, and moving off Lovable Cloud takes real work.
How much does Lovable cost?
Lovable's docs list a free plan with 5 credits a day (up to 30 a month), Pro from $25 a month for 100 credits, and Business from $50 a month for 100 credits with SSO. Higher credit tiers cost more. Unused credits roll over for a limited time, and since June 2026 one credit balance covers both building and running your app.
Can I export my code from Lovable?
Yes. Lovable has two-way sync with GitHub, GitLab and Bitbucket, and you can deploy the frontend to Vercel, Netlify or your own server. The harder part is the backend: if you use Lovable Cloud, there's no one-click move to your own Supabase project, and the database export doesn't include storage files or secrets.
Is Lovable safe to use?
Lovable the company is SOC 2 Type II and ISO 27001 certified and ships better security tooling than most builders, including RLS on by default and a Deep Scan. The apps are where things go wrong: the browser talks to the database directly, so a weak row-level security policy exposes data to anyone. Lovable apps have leaked user data more than once, so check your policies before launch.
What are the best Lovable alternatives?
The builders most often compared with Lovable are Bolt.new, v0, Replit, Base44 and Emergent. Emergent is the most different: it puts a FastAPI backend between the browser and the database instead of relying on row-level security. Developers who can work in an editor often move to Cursor or Claude Code once a Lovable project outgrows it.
Shipped something on Lovable?
Scan the published URL for exposed keys, missing headers, open files and other issues Lovable's own scans don't cover. No signup needed to see your first results.