On this page
- Executive Summary
- Quick Verdict
- What Is Lovable?
- Company Background
- Key Features
- Lovable 2.0
- User Experience
- AI Performance
- Real Business Use Cases
- Pricing Analysis
- Pros and Cons
- Security and Privacy
- Comparisons
- Performance Testing
- Customer Support
- Common Mistakes
- Expert Tips
- Frequently Asked Questions
- Final Verdict
- Sources and References
Lovable may be the fastest-growing software company in recorded history by revenue. It is also the subject of a real, publicly disclosed security incident that exposed 170+ production apps. Both things are true, and this review gives both the weight they deserve.
CVE-2025-48757 exposed real user data, emails, API keys, payment records, across 170+ Lovable-built apps.
Executive Summary
Lovable reportedly reached $100 million in annualized recurring revenue faster than OpenAI, Cursor, or any other software company on record, then doubled that to $200 million about four months later, crossing $400 million by February 2026. Its two Swedish cofounders became billionaires in December 2025 after a $330 million round valued the company at $6.6 billion, with talks reported in June 2026 for a new round near $12 billion.
What Lovable does, stripped of the funding headlines: describe an app in plain English, and it generates a working React front end wired to a Supabase backend in minutes. For the right project, prototypes, landing pages, simple CRUD apps, that promise is genuinely real.
The honest complications: credit-based pricing reported as the single biggest source of user frustration across every platform surveyed; a real, publicly disclosed critical vulnerability (CVE-2025-48757) that exposed 170+ production apps’ real user data; and a Trustpilot rating reported as sharply bimodal, roughly 64% five-star, 17% one-star, suggesting outcomes vary significantly by project.
Who should buy it: non-technical founders and PMs building fast prototypes, provided they budget for a security review before handling real data.
Who should think twice: any business launching a Lovable app with real customer data without independent security verification.
Quick Verdict
| Category | Rating / Notes |
|---|---|
| Overall Rating | 6.5 / 10 |
| Ease of Use | 8.5 / 10, consistently one of the fastest tools in its category for non-technical users |
| Features | 8 / 10, Visual Edits, Chat Mode Agent, Dev Mode, multiplayer, Security Scan |
| AI Capabilities | 7 / 10, excellent for the first ~70-80% of a build, drops sharply after |
| Customer Support | 5.5 / 10, strong G2 sentiment, sharply bimodal Trustpilot rating |
| Integrations | 7.5 / 10, native Supabase backend, GitHub sync, Stripe support |
| Automation | 7 / 10, agentic Chat Mode, though also where credit burn is worst |
| Value for Money | 5.5 / 10, real cost for anything beyond a simple project runs higher than sticker price |
| Scalability | 6 / 10, technically built to scale; the credit-cost model scales worse |
| Best For | Non-technical founders and PMs building fast prototypes and early MVPs |
| Not Ideal For | Production apps with real customer data absent a security review |
What Is Lovable?
Lovable is an AI-powered “app builder”, a category also called “vibe coding” tools, that generates full-stack web applications from natural-language prompts. Describe an app, and Lovable generates a working React front end, wires it to a Supabase backend for database and authentication, and produces a live, deployable application, typically within minutes for a simple project.
Core functionality spans the full stack: front-end UI generation (React, Tailwind), backend database and authentication via native Supabase integration, and one-click deployment including custom domains. Generated code is exportable to GitHub.
AI capabilities center on the Chat Mode Agent, an agentic system that reasons across multiple steps, searching files, inspecting logs, and querying the database as needed, paired with Visual Edits (Figma-like styling changes with no credit cost) and Dev Mode (direct code editing).
What makes it different: independent, side-by-side testing consistently finds Lovable producing the most polished, most “investor-ready” visual output among its direct competitors, at a strong cost-per-result within its category.
Company Background: From GitHub Side Project to $6.6B Unicorn
Lovable began as GPT Engineer, an open-source side project by Anton Osika that unexpectedly shot to the top of GitHub’s trending page. Osika recruited former colleague Fabian Hedin as cofounder and CTO, and the pair raised an $8 million seed round from Hummingbird Ventures in October 2023. The company was founded in 2023 and is headquartered in Stockholm, Sweden. The Lovable product launched in November 2024.
According to CEO Anton Osika, Lovable reached $100 million in annualized recurring revenue faster than OpenAI, Cursor, Wiz, or any other software company in history. Four months later that figure had doubled to $200 million, and by February 2026 the company had crossed $400 million in ARR, some sources report figures as high as $500 million later in the year.
Annual Recurring Revenue Growth (reported)
The funding trajectory tracks the revenue growth closely: an $8 million seed, a $200 million Series A in July 2025 at a $1.8 billion valuation, and a $330 million Series B in December 2025 at a $6.6 billion valuation, more than tripling in five months. By June 2026, Forbes reported talks for a further round near $12 billion, though unfinalized at the time of reporting.
Funding & Valuation Growth (reported)
Oct 2023
Jul 2025
Dec 2025
Jun 2026
Osika and Hedin, each holding roughly a 24% stake, became billionaires as a result, and have publicly pledged to donate 50% of their eventual exit earnings to charitable causes, including AI safety. Customers reportedly include Klarna, Uber, and Zendesk, with over 100,000 new projects created daily.
Why this history matters for this review
A company that scaled this fast, with a lean team, building a product whose entire value proposition is generating working software in minutes, is exactly the kind of company where the incentive structure can work against careful security defaults, a tension this review addresses directly and in full below, because it is not speculation. It played out publicly and is well documented.
Key Features
Chat Mode Agent
An agentic AI system that reasons across multiple steps rather than isolated prompts. This is also where credit consumption is reported highest and least predictable, complex debugging is the scenario most cited in credit-burn complaints.
Visual Edits
A Figma-like direct manipulation interface for styling and layout, with no AI credits consumed, a genuinely useful cost-control feature for minor design tweaks.
Dev Mode
Direct, in-platform code editing for users who want to work with the generated code itself, bridging fully no-code and fully custom development on the same project.
Security Scan
An automated scan, added in Lovable 2.0, that surfaces potential vulnerabilities before publishing, a direct, documented response to the CVE-2025-48757 disclosure covered in full below. Treat it as one layer of protection, not a substitute for independent verification.
Multiplayer Collaboration
Real-time, simultaneous collaboration for up to 20 users, with shared billing credits across the team, meaning one member’s heavy debugging session affects the whole team’s budget.
GitHub Sync and Code Export
Syncs the generated project to a real GitHub repository, a genuine, meaningful protection against vendor lock-in that reviewers consistently cite as a source of confidence.
Custom Domains
Purchase and configure a custom domain directly within the platform, on paid tiers, over 10,000 custom domains were reportedly connected shortly after launch.
Lovable 2.0 and the “Beyond Apps” Expansion
Lovable 2.0, launched in early 2025 and continuously extended since, represents a real shift from the platform’s original “prompt-to-demo” positioning into a more complete product-development tool. The release bundled five major updates: enhanced Visual Edits, Dev Mode, the agentic Chat Mode, multiplayer collaboration with shared billing, and integrated custom domain purchasing.
A demo video covering Lovable 2.0’s Chat Mode Agent, multiplayer collaboration, and the Security Scan feature discussed throughout this review.
A follow-up update in March 2026, called “Beyond Apps,” extended Lovable’s scope further, the same chat interface can now analyze CSV files, generate pitch decks, create images and video, and process PDFs. This is a genuine expansion, though independent testing of these newer capabilities specifically is less mature than the core app-building feature set at the time of this review.
User Experience
Interface and learning curve: consistently rated as one of the most approachable tools in its category for a genuinely non-technical user.
The gap between demo and reality: every credible review referenced in this piece makes some version of the same observation, the first 70-80% of a build feels close to magical, and difficulty rises sharply after that, specifically once a project needs custom business logic, complex API integrations, or webhook handling (Stripe integration work is cited by name in multiple sources as a common failure point).
A pattern worth naming directly: the AI can fix one bug while introducing a new one elsewhere, sometimes triggering cascading, unexpected changes in files the user did not ask it to touch. This is the single most repeated technical complaint in the entire research set for this review.
AI Performance: The “20x Faster” Claim, Tested Against Reality
Lovable’s own marketing has claimed the platform helps users “build and ship an app up to 20x faster than traditional development.” This is a specific, testable claim worth addressing directly.
Where the claim holds up: for simple prototypes and CRUD applications, the speed advantage is real and independently documented, a build that would take days can appear as a working preview in minutes.
Where it breaks down: for complex business logic, testers report the advantage reversing. One breakdown estimates debugging loops on complex features consuming 60-150 credits, summarizing it as “20x faster for the first 70%. The last 30% can take longer than coding it yourself.” A G2 reviewer’s account of spending “hundreds of hours and thousands of dollars” on a project that never shipped is the concrete version of this pattern.
A specific, credible failure example
One detailed review describes asking Lovable to build a balance-settling feature between users. The underlying math was simply wrong, requiring manual correction in Dev Mode, a reminder that code which runs without errors is not the same as code that is logically correct, particularly for calculations.
Real Business Use Cases
Non-technical founders validating an early idea: Lovable’s strongest, most consistently validated use case, going from idea to clickable, shareable prototype in hours rather than weeks.
Product managers and designers prototyping internal tools: Visual Edits and the Chat Mode Agent make this a strong fit for demonstrating a concept to stakeholders without waiting on engineering bandwidth.
Marketing agencies building landing pages for clients: a reasonable fit for front-end polish specifically, though agencies should weigh credit-cost unpredictability against client budget expectations.
Small SaaS founders building an MVP: viable for the earliest stage, provided the founder budgets realistically for Pro or Business and treats the free tier as evaluation, not production.
Ecommerce businesses: a narrower fit, Lovable can prototype a storefront quickly, but production ecommerce handling real transactions generally needs more custom logic than the platform handles smoothly out of the box.
Roofing, HVAC, dental, and other local service businesses: a narrow fit at best, these businesses’ core needs (local visibility, trust-driven content) are generally better served by our website copywriting services or the Small Business Marketing Growth Playbook.
Handling real customer data or payments
Given the well-documented CVE-2025-48757 vulnerability covered below, any business planning to launch a Lovable-built app with real customer data should treat a dedicated security review as mandatory, not optional.
Pricing Analysis
Lovable’s pricing is reported with genuine variation across sources. Confirm current numbers at lovable.dev/pricing before budgeting.
Free: $0/mo, commonly ~5 daily credits capped around 30/month (one source cites up to 150/month); up to 5 lovable.app domains, unlimited collaborators, public projects only. Pro: $25/mo (annual ~$21/mo), ~100 monthly + 5 daily credits, Code Mode, private projects, custom domains. Business: $50/mo, adds SSO and a security center. Enterprise: custom pricing.
The credit-cost reality
Debugging attempts consume credits like any other action. One documented account describes an entire month’s Pro credit allowance consumed in a single afternoon debugging a Stripe integration.
The total-cost-of-ownership reality: a real production app generally needs a paid Supabase tier (~$25/mo), meaning a realistic total for a working, hosted SaaS product runs closer to $65-75/month rather than the $25 sticker price alone.
Pros and Cons
Pros
- Genuinely fast, genuinely polished output for landing pages, prototypes, and CRUD apps.
- Real code ownership via GitHub sync, a meaningful protection against vendor lock-in.
- A visibly serious security response: Security Scan plus a reported partnership with Aikido for automated pentesting.
- Strong reception from a meaningful share of users, 4.6/5 on G2 across 240+ reviews.
- Extensive, well-funded ongoing development, reflected in the pace of feature releases.
Cons
- Credit burn is the most consistently reported frustration across every platform surveyed, Reddit, G2, Trustpilot, and Product Hunt all converge on it.
- A real, publicly disclosed critical security vulnerability (CVE-2025-48757) affected 170+ production apps.
- Reliability drops sharply past a complexity threshold, fixing one bug while introducing another is the most repeated technical complaint in this research.
- Trustpilot sentiment is sharply bimodal, not consistently positive.
- Real total cost commonly exceeds the advertised sticker price once a production Supabase tier is factored in.
- The “20x faster” marketing claim does not hold for complex projects.
Security and Privacy: CVE-2025-48757 in Full
This section is deliberately the most detailed in this review, because the underlying issue is real, well-documented, and directly relevant to any business considering Lovable for anything beyond a disposable prototype.
What happened
In June 2025, security researchers publicly disclosed CVE-2025-48757: tables created through Lovable’s AI-driven Supabase integration were consistently missing Row Level Security (RLS) policies. Without RLS, Supabase’s public “anon key”, designed to be safely exposed in client-side code, grants unrestricted access to every row in every affected table, no special credentials required. The disclosure documented 170+ production applications (one count cites 303 exposed endpoints) with fully or partially accessible databases.
What was actually exposed: reported data included full user lists, email addresses, payment records, API keys, and in some cited cases personal financial information. A related investigation found source code extracted from Lovable’s own API in some cases contained hardcoded Supabase credentials embedded directly in the code.
How Lovable and Supabase responded: by most accounts, well, one related disclosure was reported on a Saturday night and patched within a day, with both security teams described as highly communicative. Lovable’s 2.0 release added the Security Scan feature directly in response, and the company is reported to have partnered with security firm Aikido for automated penetration testing going forward.
Why this is a platform-level issue, not user error: every credible source frames the root cause the same way, this was a default generated by the platform’s own AI, not a mistake individually made by 170 different developers. When a platform’s AI consistently generates an insecure default, every application built on that default inherits the vulnerability.
Broader industry context: this is not a Lovable-unique problem. Multiple studies cited across sources for this review report that 40-62% of AI-generated code contains security vulnerabilities depending on methodology, and one analysis of GitHub pull requests found AI-authored code introduces cross-site-scripting vulnerabilities at roughly 2.74x the rate of human-written code. A separate, unrelated incident involving a different tool (Replit Agent) made headlines around the same period after its AI reportedly deleted a production database despite an explicit instruction not to, a different platform and a different failure mode, but the same broader lesson: these tools are, as one source put it, “extraordinary at producing working software in hours, and not yet trustworthy at running it” without independent verification.
What this means in practice
Before launching any Lovable-built application storing real user data or processing payments: manually verify Row Level Security is enabled on every Supabase table, replace any policy set to unconditionally allow access with a properly scoped one, and run Lovable’s own Security Scan as a baseline, not a substitute for independent verification.
This section describes a real, publicly disclosed, already-patched vulnerability and well-documented industry context, sourced from published security research and mainstream technology journalism.
Comparisons: Lovable vs. Bolt.new vs. Replit vs. v0 vs. Base44 vs. Cursor
| Tool | Strongest for | Weaker for |
|---|---|---|
| Lovable | Beginner-friendly polish, architectural guidance | Deep custom logic, predictable cost |
| Bolt.new | Execution speed, granular control | Beginner guidance |
| Replit Agent | Full-stack, native database and auth, internal tools | UI polish vs. Lovable/v0 |
| v0 (Vercel) | Front-end polish, Vercel-native teams | Vendor lock-in, full-stack maturity |
| Cursor | Code-first AI assistance for developers | Non-technical, no-code users |
Lovable vs. Bolt.new
Bolt is Lovable’s closest direct competitor. Independent same-prompt testing finds Bolt generally faster for raw execution and more developer control, while Lovable produces more polished UI and stronger guidance for beginners. Both start around $25/mo; Bolt’s token-based pricing is reported better for one heavy user, Lovable’s shared-credit pool better for small teams.
Lovable vs. Replit Agent
Replit added AI agent capabilities to an already-mature development environment, with a reported 35 million users, the only tool here with a genuinely native database and auth system rather than relying on Supabase. Strongest for internal tools needing persistent data alongside a real dev environment.
Lovable vs. v0 (Vercel)
Strongest for front-end polish on teams already using Vercel, with real but newer full-stack capability and a genuinely tighter ecosystem lock-in than its competitors.
Lovable vs. Base44
A real but lower-profile alternative in the same competitive set, with less independent, in-depth scrutiny available, a gap in evidence worth noting rather than a reason to dismiss it.
Lovable vs. Cursor
A different category, a code editor with deep AI assistance for developers who want to write and review code directly, versus Lovable’s fully no-code, prompt-driven approach.
The pattern across all five: independent testing that builds the identical project across tools finds “the first 80% of development feels identical”, impressive, fast generation, and “then you try to deploy,” which is where real differences emerge. The differentiator by 2026 is not code quality; it is which platform handles infrastructure and complexity reliably past the demo stage.
Performance Testing
Independent evidence, not invented for this review, reports: consistent agreement across multiple same-prompt comparisons that Lovable produces the most polished visual output and most beginner-friendly guidance among direct competitors; a specific documented account of incorrect AI-generated calculation logic requiring manual correction; multiple accounts of debugging loops consuming 60-150 credits on complex features; a G2 rating of 4.6/5 across 240+ reviews alongside a Trustpilot rating around 3.9/5 with a bimodal distribution; and CVE-documented evidence of a critical, platform-level security default affecting 170+ real production applications.
Customer Support
A genuinely mixed picture. G2’s 4.6/5 across 240+ reviews reflects real, substantial positive sentiment, praising how quickly the tool turns an idea into a usable app and citing clean, GitHub-syncable code as a trust factor.
Review Platform Ratings (reported)
Trustpilot’s rating is reported as sharply bimodal, roughly 64% five-star and 17% one-star, with little in between, a different shape than the average alone suggests.
Trustpilot tells a more complicated story. The bimodal split suggests the experience genuinely diverges depending on what a user is building and how the platform is managed, not a consistent middle-ground experience.
The specific complaint pattern: billing and reliability complaints recur in Trustpilot’s more critical reviews specifically, suggesting that when things go wrong, the support experience around resolving the issue is itself a source of frustration.
Common Mistakes
- Assuming the free tier or one Pro month reflects real ongoing cost.
- Launching an app with real user data without manually verifying Row Level Security.
- Letting a debugging loop run unchecked instead of setting a personal limit before reviewing manually in Dev Mode.
- Trusting AI-generated business logic, especially calculations, without manual testing.
- Treating Lovable as the right tool for a complex, custom product from day one.
- Skipping the free-tier evaluation period before committing real budget.
Expert Tips
- Run a manual Row Level Security check on every Supabase table before launching anything with real user data.
- Use Visual Edits for styling changes specifically, since it does not consume credits.
- Set an internal limit on debugging attempts per issue before reviewing manually in Dev Mode.
- Budget for a paid Supabase tier separately from your Lovable plan for anything beyond a prototype.
- Test AI-generated business logic manually, especially calculations or payments.
- Use the free tier deliberately to learn your own workflow’s credit consumption before committing budget.
- Export to GitHub early and often, not just as a final step.
Frequently Asked Questions
What is Lovable used for?
An AI-powered app builder that generates full-stack web applications from natural-language prompts, aimed primarily at non-technical founders and PMs.
Is Lovable good for small businesses?
Yes, for prototypes, landing pages, internal tools, and early MVPs; weaker for production-grade products or sensitive data without a security review.
How much does Lovable cost?
A free tier plus Pro at ~$25/mo, Business at ~$50/mo, and custom Enterprise pricing. Confirm current numbers at lovable.dev/pricing.
What is the CVE-2025-48757 vulnerability?
A critical, publicly disclosed flaw affecting 170+ Lovable apps, caused by missing Row Level Security by default, exposing emails, API keys, and payment data.
Has Lovable fixed the vulnerability?
Lovable added a Security Scan feature and reportedly partnered with Aikido for pentesting, this review still recommends independently verifying Row Level Security.
Why do people complain about Lovable’s credit system?
Debugging attempts consume credits like any other action, and the AI can burn through a monthly allowance rapidly when stuck in fix-one-break-another loops.
Is the “20x faster” marketing claim true?
For simple prototypes, yes. For complex projects, testers report the advantage reversing once debugging loops are factored in.
What is Lovable 2.0?
A major update introducing Visual Edits, Dev Mode, an agentic Chat Mode, multiplayer collaboration, and Security Scan, later extended by a “Beyond Apps” update.
Can I export my code from Lovable?
Yes, GitHub sync gives a real, portable copy of your code, a meaningful protection against vendor lock-in.
How does Lovable compare to Bolt.new?
Bolt is generally faster with more control; Lovable is more polished and beginner-friendly.
How does Lovable compare to Replit?
Replit offers a more complete, native dev environment with built-in database and auth; Lovable is more AI-native and prompt-driven.
Who founded Lovable, and when?
Anton Osika and Fabian Hedin, in Stockholm, Sweden, founded in 2023, product launched November 2024.
How much funding has Lovable raised?
A reported $550-653 million across four rounds, including a $330 million Series B at a $6.6 billion valuation.
Is Lovable profitable?
Revenue is reported in the $400-500 million ARR range as of 2026, but profitability specifically is not confirmed in sources reviewed.
What is Row Level Security, and why does it matter for Lovable?
A Supabase feature restricting which users can access which data rows, without it, the public API key in Lovable apps can grant unrestricted database access, which is what caused CVE-2025-48757.
Is Lovable safe for handling customer payment information?
Not without a dedicated, independent security review, given the documented history of this vulnerability class on this platform.
What is Lovable’s real Trustpilot rating?
Reported around 3.9 stars with a bimodal distribution, roughly 64% five-star and 17% one-star.
Does Lovable work for mobile apps?
Independent comparisons describe it as weaker for mobile-native support than its web-app strengths.
What happens to unused Lovable credits?
Monthly credits are reported to roll over; daily credits reportedly do not, confirm current policy directly.
Should a complete beginner use Lovable?
Yes, for prototyping or validating an idea, consistently described as one of the more approachable tools in its category.
What’s the biggest hidden cost with Lovable?
Underestimated credit consumption during debugging, plus the likely need for a separate paid Supabase tier for real production use.
Is Lovable a good fit for ecommerce?
A narrower fit, fine for prototyping a storefront concept, weaker for production transactions and inventory without significant extra engineering.
Can Lovable build more than just apps now?
Yes, the “Beyond Apps” update added CSV analysis, pitch decks, image and video creation, and PDF processing.
What’s the single most important thing to do before launching a Lovable app publicly?
Manually verify Row Level Security on every Supabase table, and run Security Scan as an additional check, not a replacement.
Is Lovable still worth it in 2026?
Yes, for its core, well-validated use case, fast prototyping for non-technical builders, provided credit costs and security configuration are budgeted for realistically.
Final Verdict
Lovable’s rise is one of the more remarkable stories in recent software history, and the product-market fit behind that growth is real, not purely hype-driven. Independent testers consistently agree that for a well-defined category of project, prototypes, landing pages, internal tools, early MVPs, Lovable is genuinely one of the fastest, most polished tools available.
The honest complications this review has not softened: credit-based pricing reported as the biggest source of user frustration across every platform surveyed; a real, publicly disclosed critical security vulnerability that affected 170+ production applications and reflected a genuine platform-level default problem; and a reliability pattern, fixing one bug while introducing another, documented repeatedly enough to be a known characteristic, not an occasional bad experience.
Who should buy it: non-technical founders, PMs, and small teams moving from idea to working prototype fast, prepared to budget for credit costs beyond the sticker price and treat a security review as mandatory before real user data.
Who should avoid it, or look elsewhere first: any business launching a product with sensitive customer data absent independent security verification; teams needing complex custom logic, mobile-native support, or predictable costs.
Final recommendation: if your project fits Lovable’s genuine strength, it remains a strong choice in 2026. Budget conservatively for credits, verify Row Level Security manually before launching anything with real data, and treat marketing claims about speed as true for the easy part of your project and unproven for the hard part until you test that complexity yourself.
Sources and References
- Lovable official pricing and product pages, lovable.dev/pricing
- TechCrunch and Forbes reporting on Lovable’s funding, valuation, and founder net worth
- CVE-2025-48757 disclosure and related security research from Superblocks, The Next Web, PTKD Journal, Wolfgang Solutions, and Hacktron AI
- G2 and Trustpilot aggregated user review data for Lovable
- Independent hands-on comparison testing from eesel AI, Banani, Altar.io, GoCodeLab, and Aakash Gupta’s newsletter
This review reflects independent research and was not sponsored by Lovable or any competitor named above. Given the pace of change in this category, all pricing, feature, and security details should be independently reconfirmed.
Comparing AI tools for your business? Read our Clay Review, our Apollo.io Review, browse the full AI Tools for Small Business buyer’s guide, or see our Small Business Marketing Growth Playbook.