Lovable review: full-stack apps from chat, with the code in your hands

Contents

1. What Lovable builds
2. Security
3. Strengths and limits
4. Pricing
5. Questions to ask before building on Lovable
6. Sources

Type	AI app builder
Headquarters	Stockholm, Sweden
Founded	2023
Pricing	Published
Website	lovable.dev

Lovable, founded in Stockholm in 2023, turns a conversation into a full-stack web app⁠1Lovable (company)Wikipedia. Its built-in backend, based on Supabase, provides a database, storage, authentication, realtime and functions, and every project can sync two ways with a GitHub repository⁠23Built-in backend (Lovable Cloud)Lovable DocsSync your Lovable project with GitHubLovable Docs.

Best for: A custom web app whose code the company wants to own, built by someone willing to design the data model and test the security themselves.

Not the right fit for: Teams without anyone to own access rules, data security and maintenance once the app holds real customer or financial data.

What Lovable builds

Lovable works in two modes. Plan mode costs one credit per message; build mode charges according to the work, with Lovable's own examples ranging from 0.5 credits for a colour change to 1.2 credits for adding authentication and 2 credits for a landing page with images⁠4Plans and creditsLovable Docs. The result is a custom application: the screens, the data model and the access rules are whatever the conversation produced.

For a company, the attraction is ownership. GitHub sync works on every plan and repositories are private by default; Enterprise adds GitHub Enterprise Cloud and Server⁠3Sync your Lovable project with GitHubLovable Docs. Workspaces allow unlimited members on all plans, so the cost depends on credits rather than seats⁠5Subscription plansLovable Docs.

Security

A basic security scan runs on every publish and checks database configuration and row-level security rules in about 10 to 15 seconds, and admins can block publishing on critical findings⁠6Security at LovableLovable. Lovable's documentation is also clear about the limits: scans cannot guarantee complete security, and the customer is responsible for ensuring the app meets the security requirements of its use⁠7Security overviewLovable Docs. The caution has a history. In 2025 a researcher found inadequate row-level security in 170 of 1,645 Lovable projects, which became CVE-2025-48757; Lovable disputes the CVE because each customer configures its own app⁠89Statement on CVE-2025-48757Matt Palmer · 29 May 2025CVE-2025-48757 recordMITRE CVE Program · 30 May 2025.

Governance features are tiered: user roles on Pro, SSO and a security centre on Business, and audit logs, SCIM and scheduled security scans on Enterprise⁠5Subscription plansLovable Docs. Once the built-in backend's region is set, it cannot be changed, and there is no one-step move from the built-in backend to a customer's own Supabase project⁠2Built-in backend (Lovable Cloud)Lovable Docs.

Strengths and limits

Strengths

• The code is the buyer’s: two-way GitHub sync is available on every plan.
• A security scan runs on every publish and checks database rules; admins can block publishing on critical findings.
• Workspaces allow unlimited members on all plans, so cost is driven by credits rather than seats.

Limits

• Lovable’s own documentation says its scans cannot guarantee complete security and that the customer is responsible for the app meeting its security requirements.
• Audit logs, SCIM and scheduled security scans are Enterprise features; SSO starts on Business.
• The backend region cannot be changed once enabled, and there is no one-step move from the built-in backend to the customer’s own Supabase project.
• Starts from a blank app: the data model, roles and workflows are the builder’s to design.

Choose another option if: Nobody on the team can review database access rules, or the system is mainly records and workflows rather than a custom product. Retool or OpenLazarus carry more of that load.

Pricing

Published: Pro from $25 a month for 100 credits; Business from $50 a month for 100 credits; higher credit tiers up to 10,000 credits. Enterprise on request.

Questions to ask before building on Lovable

• Who on our side will review row-level security on every table before real data goes in?
• Which plan gives us SSO, and do we need audit logs (Enterprise) for our auditors?
• Which region should the backend use, given that it cannot be changed later?
• Who maintains the app, and the GitHub repository, if the person who built it leaves?

See how Lovable compares with the other builders in the main ranking.

Sources

1. Lovable (company). Wikipedia. Accessed 8 Nov 2026.
2. Built-in backend (Lovable Cloud). Lovable Docs. Accessed 8 Nov 2026.
3. Sync your Lovable project with GitHub. Lovable Docs. Accessed 8 Nov 2026.
4. Plans and credits. Lovable Docs. Accessed 8 Nov 2026.
5. Subscription plans. Lovable Docs. Accessed 8 Nov 2026.
6. Security at Lovable. Lovable. Accessed 8 Nov 2026.
7. Security overview. Lovable Docs. Accessed 8 Nov 2026.
8. Statement on CVE-2025-48757. Matt Palmer, 29 May 2025. Accessed 8 Nov 2026.
9. CVE-2025-48757 record. MITRE CVE Program, 30 May 2025. Accessed 8 Nov 2026.

Further reading

• Buyer's guide · Updated quarterlyThe best no-code AI builders for business systems in 2026Seven AI builders judged on what an established company needs from a system it will run for years, not on how quickly a prompt becomes a demo.
• Guide · Building itHow to build an internal business app without code, step by stepThe screens are the easy part. A working internal app depends on records, roles and a plan for who keeps it running, and those are decided before the first prompt.
• Guide · PricingAI app builder pricing in 2026: credits, tokens, seats and the real billEntry prices cluster around $20 to $25 a month. The bill for a system used every day depends on the unit each builder charges in, and some of those units grow with the project.