Lovable Review — from the engineers who audit Lovable apps
Brilliant prototyping tool. Production-ready isn't its default — almost every app needs a security audit before launch.
Pros
- Genuinely fast prompt-to-fullstack generation
- Supabase backend means the database is portable
- Frontend exports cleanly to GitHub
- Great for non-developers who want a working web app fast
Cons
- CVE-2025-48757: 89% of scanned Lovable apps lacked working Row Level Security
- Stripe secret keys, Resend API keys, and Supabase service role keys regularly leak into client bundles
- AI-generated Stripe webhook handlers commonly skip signature verification
- Public checkout endpoints often accept the price/amount from the client (payment bypass)
- Regression loops that re-introduce previously fixed bugs while burning credits
- No security headers (CSP, HSTS, X-Frame-Options) on the static-hosted frontend
Lovable is good for
- Non-technical founders prototyping fast
- Marketing sites and landing pages where Supabase auth is enough
- MVP demos that won't see real users until after an audit
Lovable is the wrong call for
- Production apps shipping directly to real users without manual review
- Anyone handling money where the Stripe webhook patterns are the primary risk
- Compliance-sensitive apps
What we find when we audit Lovable apps
These are the issues we've documented from real audits and primary-source security research. Most ship to production by default.
Supabase RLS disabled or misconfigured
CVE-2025-48757 disclosed 170+ Lovable apps with 303 endpoints exposing private data. 89% of scanned apps had no working Row Level Security. The AI assistant routinely creates tables without ENABLE ROW LEVEL SECURITY, or writes policies that grant the anon role full read/write.
Secrets inlined into the client bundle
Stripe secret keys, Resend API keys, and Supabase service role keys have all been observed leaking into dist/. Lovable inlines values meant for Edge Functions into the React client when prompt phrasing is ambiguous.
Stripe webhooks without signature verification
AI-generated webhook handlers trust the request body without calling stripe.webhooks.constructEvent, allowing payment bypass via forged events. Documented across multiple security writeups.
Public checkout endpoints with overridable amounts
Edge functions accept the price or amount from the client instead of looking it up server-side from a product ID. Customers can change the value before submitting.
Edge Function CORS + verify_jwt mismatch
Auth flows fail with 401 'Missing authorization header' because verify_jwt is left on for webhook endpoints. The AI's typical fix is to disable JWT verification entirely, removing all auth.
Regression loops that consume credits
Users report the AI re-introducing previously fixed bugs while consuming credits, often because Lovable doesn't read the full file before editing.
The real cost of Lovable
Lovable's subscription is reasonable for what you get, but Lovable Cloud usage is metered separately. A chatty Edge Function can blow the bill silently. The real cost trap is the 'fix loop' — each failed attempt re-sends full project context, and a single CORS bug in your Supabase dashboard (which Lovable can't see) can chew through a month of credits in a day.
Lovable FAQs
- Is Lovable legit?
- Yes. Lovable is a well-funded, real platform with thousands of paying users and a real product. The question isn't whether the platform is legit — it's whether the code it generates is production-ready. Independent research suggests it usually isn't without a manual review.
- Is Lovable safe to use?
- The platform itself is fine. The apps it builds frequently aren't. CVE-2025-48757 documented 170+ Lovable apps with 303 endpoints exposing private data via missing or misconfigured Supabase RLS. The platform has improved its prompts since, but the failure mode still ships in new apps. Audit before launch.
- Is Lovable free?
- There's a free tier with limited credits. Real usage requires a paid plan. The Lovable Cloud add-on is metered separately, which means costs can spike during heavy debugging sessions even on a fixed monthly subscription.
- Are Lovable apps production-ready?
- Almost never out of the box. They look great and feel functional, but the default failure modes (RLS misconfigured, secrets in client bundles, Stripe webhooks unverified) are the exact things that get apps owned in production. We audit Lovable apps for these patterns starting at $300.
Built something with Lovable? Let us audit it.
Senior engineer review of your Lovable app. From $300.