Item: Lovable
Author: Elena Marchetti

Lovable is the fastest-growing SaaS startup in European history. From zero to $200 million in annual recurring revenue in under a year. A $6.6 billion valuation after just two funding rounds. Over 25 million projects created on the platform. Those numbers are staggering, and they tell you something important: there's enormous demand for a tool that lets people describe an app in plain English and get working software back. After three weeks of building real projects on Lovable, I can tell you the demand is justified - but so are the concerns.

TL;DR

7.0/10 - The fastest way to go from idea to working prototype, held back by serious security defaults and credit-burning debugging loops
Key strength: Produces truly attractive, full-stack React/TypeScript apps from natural language, with one-click Supabase integration and deployment
Key weakness: Apps ship with critical security misconfigurations by default - RLS policies, exposed API keys, and zero input validation have already leaked real user data
Best for solo founders verifying ideas, internal tools, and hackathon prototypes. Skip if you need production security, complex business logic, or anything beyond React/Supabase

From GPT Engineer to Lovable

Before diving into the product, the backstory matters. Lovable started life as GPT Engineer, an open-source project that became one of the fastest-growing repositories in GitHub history with over 51,000 stars. The commercial web version, gptengineer.app, launched in 2024 and flopped - twice. The team made a gutsy call in late 2024: kill the GPT Engineer brand completely and relaunch as Lovable.

The rebrand worked spectacularly. Within months, Lovable hit number one on Product Hunt and Hacker News. By November 2025, it had crossed $200 million ARR. In December 2025, Lovable closed a $330 million Series B led by CapitalG and Menlo Ventures, with NVIDIA, Salesforce, Atlassian, and Khosla Ventures among the investors. Total funding to date: $653 million. Whatever you think of the product, the growth story is undeniable.

What Lovable Actually Does

Lovable is a browser-based platform where you describe what you want to build in a chat interface, and AI generates a complete web application - frontend, backend, database, authentication, and deployment. The core value proposition is vibe coding taken to its logical extreme: you should never need to touch a line of code.

The tech stack is opinionated and fixed. Every Lovable app is built with React and TypeScript on the frontend, styled with Tailwind CSS and shadcn/ui components, and backed by Supabase for the database, authentication, file storage, and serverless functions. Deployment happens through Lovable's own hosting or via one-click export to Vercel or Netlify.

This matters. Lovable isn't a general-purpose code generator. It's a React/Supabase app factory with a very polished chat interface on top.

The Lovable editor combines a chat-based prompt interface with a live application preview, letting users iterate on their apps in real time Lovable's editor puts the conversation on the left and a live preview on the right - changes appear in seconds.

Building With Lovable - What Works

The first-run experience is truly impressive. I described a project management tool with user authentication, team workspaces, task boards with drag-and-drop, and real-time notifications. Within about four minutes, Lovable produced a functioning application with a clean UI, working auth flows, a Supabase database with relational tables, and a Kanban board that actually worked. The visual quality was noticeably better than what I have gotten from Bolt.new or other AI coding tools for similar prompts.

Lovable offers two build modes. Agent Mode autonomously plans, edits, debugs, and improves your codebase across multiple files. Chat Mode is more collaborative - it helps you think through architecture and implementation before executing changes. In practice, Agent Mode handles about 80% of workflows. Chat Mode is useful for complex features where you want to reason through the approach first.

The Supabase integration deserves special mention. Connecting a database is literally three clicks: go to project settings, find the Supabase tab, click Connect. Lovable auto-configures the connection, sets up tables based on your app description, produces authentication flows, and creates Row-Level Security policies. For anyone who has manually configured Supabase RLS, the time savings here are real.

GitHub sync is another strong point. Every change Lovable makes is pushed to a connected GitHub repository, giving you full code ownership and the ability to continue development in Cursor or any other IDE. The code it creates is clean enough that a competent React developer can pick it up and extend it - it isn't the spaghetti you might expect from AI-created code.

Where Lovable Falls Apart

The problems start when your app gets complex. After the initial prototype impresses you, you'll start asking for more sophisticated features - multi-step workflows, conditional logic, third-party API integrations, complex data relationships. This is where Lovable's debugging loops become a real issue.

Here is the pattern I hit repeatedly: I'd request a feature, Lovable would implement it but break something else, I would ask it to fix the broken thing, and it'd fix that while reintroducing the original issue. Each iteration burns credits. In one session, I spent 14 credits going back and forth on a Stripe integration that kept breaking the checkout flow. The AI would confidently report the bug was fixed, I'd test it, and the same error would appear. This isn't unique to Lovable - it's a problem across vibe coding tools - but the credit-based pricing makes it especially painful here.

Pricing is structured around credits, and they drain faster than you'd expect. The Pro plan at $25/month gives you 100 monthly credits plus 5 daily bonus credits, totaling roughly 250 per month. Simple prompts cost one credit; complex multi-file changes cost more. Building a meaningful application from scratch consumed about 60-80 credits in my testing. Iterating on bugs and refinements easily doubled that. The Business plan at $50/month offers the same 100 credits with additional team features - neither plan feels generous for serious use.

Lovable's Supabase integration connects your app to a PostgreSQL database with authentication, storage, and real-time features in just a few clicks The Supabase integration is Lovable's strongest technical feature - databases, auth, and storage configured automatically.

The Security Problem

This is where the review gets uncomfortable. Lovable has a documented, serious security problem, and the company's response has been inadequate.

In May 2025, researchers at Escape.tech discovered that 170 Lovable-hosted apps shared a common vulnerability: unauthenticated attackers could read and write to the Supabase databases directly using publicly exposed API keys, because Row-Level Security policies were either missing or misconfigured. The vulnerability affected 303 endpoints across those 170 apps. More recently, security researcher Taimur Khan found 16 vulnerabilities - six of them critical - in a single Lovable app that exposed over 18,000 users' data, including email addresses and partial payment information.

These aren't edge cases. When we covered the broader vibe coding security landscape, the pattern was consistent: AI coding tools don't prioritize security by default, and Lovable scored especially poorly. In the VibeScamming benchmark, which tests how easily AI builders can be exploited for phishing workflows, Lovable scored 1.8 out of 10 - meaning it readily complied with prompts designed to create malicious pages.

Lovable has responded by adding a "Security Center" in the Business plan and publishing security documentation. But the fundamental issue remains: apps built on the Free and Pro plans ship with insecure defaults, and the target audience - non-developers - is the group least equipped to identify and fix those issues. Telling non-technical users to "review their RLS policies" defeats the purpose of a no-code tool.

If you're building anything that handles user data, this isn't a theoretical concern. It is an active liability. The security defaults need to be secure out of the box, not opt-in.

How It Compares

The vibe coding landscape has gotten crowded. Lovable's direct competitors are Bolt.new and v0 by Vercel, and each occupies a slightly different niche.

Lovable vs. Bolt.new: Lovable produces better-looking apps and has a smoother non-developer experience. Bolt supports mobile development via React Native and Expo - Lovable is web-only. Bolt gives developers more flexibility in stack choices. For pure web prototyping by non-technical users, Lovable wins.

Lovable vs. v0: v0 focuses on creating individual React components and UI pieces within the Vercel ecosystem. Lovable creates full applications. They're complementary more than competitive - v0 for developers who want AI-produced components they can compose, Lovable for non-developers who want complete apps.

Lovable vs. Cursor/IDE tools: Different categories completely. Cursor and similar tools augment developers writing code. Lovable replaces the need to write code at all. If you're a developer, you'll likely get better results with Cursor. If you aren't, Lovable is the better starting point.

The honest positioning for Lovable is this: it's the best tool for non-developers who want working web app prototypes. It isn't the best tool for production applications, and it isn't trying to be - despite the marketing language that occasionally implies otherwise.

One-click deployment from Lovable to production, with GitHub integration for full code ownership and portability Deployment is truly one-click, and GitHub sync means you always own your code.

Who Should Use Lovable

Lovable is excellent for a specific set of use cases:

Founders validating ideas: If you need a functional prototype to show investors or test with users, Lovable can get you there in hours instead of weeks. The visual quality is high enough that prototypes don't look like prototypes.
Internal tools: Building a simple dashboard, admin panel, or data entry tool for your team. Low security risk, high time savings.
Hackathons and demos: When speed matters more than anything else, Lovable is hard to beat.
Learning: If you want to understand how modern web apps are structured, building in Lovable and then reading the created code in GitHub is surprisingly educational.

Lovable is a poor fit for:

Anything handling sensitive user data until the security defaults improve dramatically.
Complex business logic: Multi-step workflows, detailed permissions systems, or heavy computation will frustrate you with debugging loops.
Mobile apps: Lovable is web-only. Look at Bolt or native development tools.
Apps that need to scale: The generated code and Supabase architecture work fine for hundreds of users but have not been proven at serious scale. And criminals have already figured out how to abuse these tools for less legitimate purposes.

Verdict: 7.0/10

Lovable is a truly impressive piece of technology that's undermined by genuinely serious problems. The speed at which it turns an idea into a polished, functional prototype is unmatched. The Supabase integration is smooth. The generated code is clean enough to hand off to real developers. The design quality is the best in class among AI app builders. For the specific use case of rapid prototyping by non-technical users, nothing else comes close.

But the security defaults are unacceptable for a tool that markets itself for production use, and the credit-burning debugging loops make costs unpredictable. The $6.6 billion valuation suggests the market believes these problems are solvable - and they probably are. But they're not solved yet. Use Lovable to build your prototype. Then hand the code to someone who can actually secure it before you let real users anywhere near it.

Pricing: Free tier (5 daily credits), Pro at $25/month (100 monthly + 5 daily credits), Business at $50/month (team features + Security Center), Enterprise (custom).

Best for: Solo founders, prototype validation, internal tools, hackathons.

Skip if: You need production security, complex business logic, mobile apps, or anything beyond React/Supabase.

Sources