On this page
What you build decides how much review it needs
What are you building with Lovable?
- A prototype or demo for a meetingFineFast and cheap, with no real data.
- A site without login or client dataYes, with a checkCheck speed, search and forms.
- An app with login and client dataAfter reviewHave access rules per table checked first.
- Payments or subscriptionsAfter reviewKeys never in the browser, test webhooks.
- Health or financial dataNot as isWith a developer, and a processing agreement.
What Lovable does for you
- Screens and code from a prompt
- Setting up a database and login
- Hosting and publishing
- A security scan as an aid
What you still handle
- Who may read which database row
- Keeping secret keys out of the browser
- Testing with a second account
- Privacy, GDPR and backups
The platform is solid, your app is not by default
Lovable is a Swedish platform that builds a website or app from a description in plain language. It writes the code, sets up a database and login on Lovable Cloud, which runs on Supabase, and publishes in one click. Lovable makes what you ask for, and whoever does not ask for strict access rules sometimes gets a database that shows more than intended.
That is not theory. In 2025 a researcher found that 170 of 1,645 Lovable apps he examined had tables readable or writable without login, with names, email addresses and sometimes payment details. The issue got the code CVE-2025-48757. Lovable disputes the rating and says customers are responsible for the security of their app data. That is exactly the point: you carry that responsibility, even when AI wrote the code. How Lovable compares to a classic site is in Lovable vs WordPress.
Where a Lovable app leaks
| Part | What goes wrong | What you check |
|---|---|---|
| Database | Tables without or with too loose access rules | Per table: who may read, who may write |
| Login | Pages that stay reachable without login | Test logged out and with a second account |
| Secret keys | Payment or email service keys in the code the browser receives | All keys on the server |
| Payments | An order counted as paid without confirmation | Test your payment provider's webhooks |
| Changes | A prompt about the footer that also changes the form | Test the core functions after every change |
| Search | Older projects show Google an empty page | Projects after 13 May 2026 send full HTML |
What Lovable is good at
Speed. A first version of an idea stands after a few prompts, with screens that look finished. For a demo to investors, a test with customers or an internal tool without sensitive data that is a real advantage: such a first version is in effect a proof of concept. The code is yours, with a Git connection on every plan, and a developer can build on it later. Whether to have a whole site built by AI is covered in AI website builder. That way of building, where nobody reads the code, is called vibe coding.
What custom software costs when Lovable gets too tight is in custom software development cost; the choice itself in build vs buy software.
Is your app already live with client data?
Log out and try to view your own data through a second account. If you see what you should not, take the app offline until it is fixed. Check that your privacy policy says where data lives, and test load time with the website speed test. If your people use more AI tools than Lovable, the EU AI Act asks that they know what they are doing: see do I need an AI policy. Selling the software to others? Watch the new product liability rules for software. A classic site has other risks, mostly plugins and updates: see is WordPress safe.
Scan, handover and where your data lives
Does Lovable have a security scan?
Yes, Lovable can scan your project for known problems such as open tables. See it as an aid, not a review: it does not find everything a person with a second account finds.
Can a developer take over my Lovable app later?
Yes. The code is in Git and the database on Supabase. A developer can build on, but first checks the access rules and the structure.
Where does Lovable store my data?
In the region you picked when you started the project: Americas, Europe or Asia Pacific. It cannot be changed later, so a European business picks Europe at once.