Lovable Review 2026: Pricing, Code Export & Security

Disclosure: CodeToolPilot may earn a commission if you buy through links on this page, at no extra cost to you. How we make money.

Last verified: October 12, 2026. This is an editorial research review — how we review. Prices and plans change often; confirm on the vendor’s site.

Lovable is an AI app builder that turns a chat conversation into a full-stack web app: interface, database, authentication and a live URL. Founders and product teams use it to ship internal tools and early-stage products, and a growing number of developers use it to get past the boilerplate of a new web app.

This review looks at Lovable the way a developer or tech lead would: the generated stack and how to get the code out, Git sync, how tightly apps are tied to Lovable’s managed backend, how credit pricing behaves, and the security of generated apps, which matters because Lovable had two widely reported security episodes in 2026.

This is an editorial research review. It is based on Lovable’s documentation, pricing pages, changelog and official blog as of October 2026, plus attributed press coverage. We did not run hands-on tests.

Quick verdict

Lovable is one of the most complete “prompt to deployed app” products available. Git sync is included on every plan, including Free, and works with GitHub, GitLab and Bitbucket. Code download, custom domains and badge removal need a paid plan. Lovable Cloud gives you Postgres, auth, storage and functions without setting up a backend, and every publish runs a security scan. In return, you accept a fixed framework, a managed backend with no one-click migration path, and credit costs that vary with each task. Treat the generated code as a strong first draft, not a security-reviewed product.

Pro: Two-way Git sync on all plans, with GitHub, GitLab and Bitbucket Cloud.
Pro: A built-in backend (Lovable Cloud) with database, auth, storage, edge functions, secrets and scheduled jobs.
Pro: An automatic Quick scan on every publish and an on-demand Deep scan, both free to run.
Pro: Spend controls: credit check-ins on long tasks, workspace usage limits and alerts, and per-member caps.
Con: No choice of framework or database; new apps use TanStack Start and Postgres.
Con: Moving from Lovable Cloud to your own Supabase project is a manual rebuild.
Con: Credit cost per message varies with complexity, which makes monthly spend hard to forecast.
Con: A 2026 access-control regression exposed chats and code of public projects for about 11 weeks.

Visit Lovable

What is Lovable?

Lovable is a browser-based builder with an AI agent. You describe a feature, and Lovable plans it, writes the code, and runs a preview. When you publish, the app goes to a Lovable URL or your own domain. According to Lovable’s FAQ, new apps created since May 13, 2026 (June 22, 2026 for Enterprise workspaces) use TanStack Start with server rendering. Older apps use React and Vite and render in the browser. The FAQ is explicit that “Lovable does not offer a choice of framework or database.” The database is PostgreSQL, through Lovable Cloud or a Supabase project you connect.

The FAQ says your apps and code are yours, that you can use them commercially, and that you can host them wherever you like. Lovable also publishes a guide to deploying and hosting outside Lovable.

Key features

Plan, Build and Chat modes

Plan mode costs 1 credit per message. Build mode costs vary with the work. Lovable’s examples range from 0.50 credits to change a button color to 2.00 credits for a landing page with generated images. Chat messages usually cost a fraction of a credit. In August 2026, build messages became able to run for up to 10 hours, with cost scaling to match, and a /goal command lets the agent keep working until a goal is met. Credit check-ins (in beta) pause long messages at a set cost, 20 credits by default, so you can decide whether to continue.

Git sync and code export

Git sync is two-way on one active branch. Lovable pushes its changes, and anything you push to that branch from your IDE syncs back. Lovable always creates a new repository, so you can’t connect an existing one. Reconnecting after a disconnect also creates a new repository. GitHub, GitLab and Bitbucket Cloud (added in September 2026) are supported, and GitHub Enterprise is reserved for the Enterprise plan. Paid plans can also download the codebase as a .zip. Since October 2026, Cloud database changes are saved as Drizzle migration files in the repository, so the schema history travels with the code.

Lovable Cloud

Lovable says Lovable Cloud uses “Supabase’s open-source foundation.” It includes a database with table editing and backups, authentication, storage, edge functions, secrets, scheduled jobs, logs and a SQL editor. Usage is billed from the same credit balance you use for building. Recent updates added database size options with estimated monthly cost, load warnings and password rotation. The important limit: “There is no one-click migration” from Cloud to your own Supabase project. A database export excludes stored files, edge function code and secrets.

Security scanning

A Quick scan runs on every publish. It checks database access rules (including tables without row-level security), dependencies with known vulnerabilities, and unauthenticated MCP servers. A Deep scan, started manually, reviews access control, unauthenticated endpoints, unsafe input, leaked secrets, payment logic and auth weaknesses. Lovable also automatically revokes workspace API keys that leak in public GitHub repositories. The docs state that these tools “cannot guarantee complete security,” and recommend a professional review for sensitive apps.

Workspaces and governance

Workspaces have unlimited members on every plan. Pricing is per credit rather than per seat, and owners can set default and per-member credit limits. Business adds SSO, a security center, Restricted project access, commit attribution and workspace data excluded from AI training by default. Enterprise adds SCIM, audit logs, scheduled security scans and EU inference.

Who should use Lovable

Lovable suits startups and product teams that want a hosted full-stack web app with auth and a database in days. It also suits agencies building client prototypes, and developers who are happy with TanStack Start, Postgres and Supabase-style backends and want a Git repository from the start.

Who should skip it

Skip Lovable if you need a specific framework, such as Next.js or a non-JavaScript back end, or your own cloud infrastructure from day one. It is also a poor fit if you need strictly predictable monthly costs, or if you handle sensitive data and cannot fund an independent security review of the generated code.

Strengths and limitations

Strengths

Lovable covers the whole path from idea to a hosted app with a real backend, and Git sync is free. A non-technical colleague can build in Lovable while a developer reviews and extends the same repository in their own editor. Drizzle migration files and the zip download make leaving later more realistic.

Its security tooling is among the most complete in this category. Scans run automatically on publish and check for missing row-level security. Leaked keys are revoked. You can add Wiz or Aikido (billed separately) for deeper checks. Its spend controls, including per-message cost display, check-ins and workspace limits, reflect real lessons about runaway agent bills.

Limitations

You cannot choose the framework or database. Leaving Lovable Cloud is a manual migration, not a switch, and a database export leaves out stored files, edge function code and secrets. Hosting on Lovable also has gaps. For example, the docs say it does not support 301 redirects between connected domains.

Credit costs are variable by design. A small edit and a 10-hour autonomous run draw from the same balance. Cloud hosting and in-app AI features draw from it too, so a successful app can consume credits you had planned for building.

Security deserves careful attention. In February 2026, The Register reported that an app showcased on Lovable’s Discover page had exposed data on 18,697 users through missing access controls and inverted auth logic. Lovable responded that its pre-publish scan recommendations had not been implemented, and that the vulnerable database was not hosted by Lovable. In April 2026, Lovable confirmed that a backend regression had let any Lovable user with a project link read the chat history and source code of public projects between February 3 and April 20, 2026. Its official response says private projects and Lovable Cloud were not affected. Lovable then made existing public projects private, and new public projects can no longer be created. The lesson for developers: check generated access rules yourself, and treat project visibility settings as security settings.

Pricing (as of October 2026)

Plan	Price	What you get
Free	$0	5 daily build credits (capped at 30 per month), plus monthly grants of 20 Cloud and 4 AI credits; workspace-private projects; Git sync; unlimited members
Pro	From $25/month or $250/year for 100 credits; tiers up to 10,000 credits ($2,250/month)	Everything in Free, plus code download, custom domains, removal of the “Edit with Lovable” badge, design systems, user roles, credit rollover and top-ups ($15 per 50 credits)
Business	From $50/month or $500/year for 100 credits; tiers up to 10,000 credits ($4,300/month)	Everything in Pro, plus SSO, security center, Restricted projects, internal publishing, Lovable API, preview-link passwords, and workspace data excluded from training by default; top-ups $30 per 50 credits
Enterprise	Custom	Volume credit pricing, SCIM, audit logs, scheduled security scans, EU inference and GitHub Enterprise support

Unused monthly credits expire two months after they are issued. Daily grants don’t roll over, and top-ups last 12 months. Lovable’s docs say the monthly Cloud and AI grants are temporary and subject to change. Verified students and teachers can get 50% off Pro. Check Lovable’s pricing page for current tiers before you commit.

See Lovable pricing

Prices verified on October 12, 2026 against the official Lovable pricing page. Plans change often — confirm on the vendor’s page before you buy.

Use cases

Lovable fits best when its fixed stack, TanStack Start with Postgres, is acceptable and you want a Git repository from day one. The scenarios below follow Lovable’s documentation, and each one notes the main caveat for developers.

A startup MVP with auth and a database

A small founding team can describe a product and get a hosted app with Postgres, authentication, storage and edge functions on Lovable Cloud, without provisioning a backend. Plan mode lets the team agree on an approach before Build mode starts writing code. The caveat is the exit: there is no one-click migration from Lovable Cloud to your own Supabase project, so decide early how long the app should live on Lovable’s managed backend.

Non-developers build, developers review in Git

A product manager or designer can iterate in Lovable while a developer works on the same code in their own IDE, because Git sync is two-way and included on every plan. Commits pushed to the active branch sync back into Lovable. Sync covers only one active branch and Lovable always creates a new repository, so agree on a branching and review routine before both sides start editing.

Internal tools on the Business plan

Companies building internal dashboards or admin tools can use the Business plan’s SSO, Restricted project access and internal publishing, with workspace data excluded from AI training by default. Per-member credit limits help keep many contributors within budget. Cloud hosting and in-app AI features draw from the same credit balance as building, so a heavily used internal tool keeps consuming credits after it ships.

Agency prototypes handed over to a client

Agencies can build a client prototype in Lovable, then hand over the repository, or a .zip download on paid plans, for the client’s developers to host elsewhere using Lovable’s guide to hosting outside Lovable. Since October 2026, Cloud database changes are saved as Drizzle migration files in the repository, which makes the schema easier to recreate. A database export still leaves out stored files, edge function code and secrets, so budget time for that part of the handover.

Alternatives

Bolt.new: a similar builder with token-based pricing, repository import and a choice of Bolt Database or Supabase.
v0: Vercel’s builder, with branches, previews and pull requests per chat, aimed at Next.js teams.
Replit: a broader cloud workspace and agent that supports many languages, with several deployment types.
Claude Code: a terminal coding agent for developers who want to continue a Lovable export in their own repository and tools.

Final verdict

Lovable is a capable, fast way to go from prompt to a hosted full-stack app, and its free Git sync and clear code-ownership terms give developers a real exit route. The trade-offs are a fixed stack, a managed backend that is slow to leave, and variable credit costs. Its 2026 security history means generated apps should be reviewed like any untrusted code before they hold real user data.

Try Lovable

FAQ

Is Lovable free?

Yes. The Free plan includes a small daily allowance of build credits with a monthly cap, workspace-private projects, Git sync and unlimited workspace members. Code download, custom domains and removing the “Edit with Lovable” badge require a paid plan. Check Lovable’s pricing page for current credit amounts.

Do I own the code Lovable generates?

Yes. Lovable’s FAQ says your apps, code and content are yours, subject to third-party rights such as open-source licenses. You can modify them, use them commercially and host them wherever you choose, and Lovable publishes a guide to deploying and hosting outside Lovable.

Can I connect Lovable to an existing GitHub repository?

No. Lovable’s FAQ says you cannot connect an existing repository or start a project from one, and connecting a project to GitHub, GitLab or Bitbucket Cloud always creates a new repository, as does reconnecting after a disconnect. Once connected, sync is two-way on one active branch. GitHub Enterprise is supported only on the Enterprise plan.

Can I move a Lovable app off Lovable Cloud?

Yes, but it is a manual job. Lovable’s docs say there is no one-click migration from Lovable Cloud to your own Supabase project, and a database export leaves out stored files, edge function code and secrets. Drizzle migration files in the repository, added in October 2026, and the code download on paid plans make the move more realistic.

Does Lovable use my data to train AI models?

On Free and Pro plans, it may. Lovable’s FAQ says that as of September 9, 2026, it may use customer data from Free and Pro plans to train its models unless you opt out by turning off “Use my Lovable content for model training” under Account settings, Preferences, AI model training. On Business and Enterprise, workspace data is excluded from training by default.

Is Lovable secure?

Lovable runs a Quick scan on every publish and offers an on-demand Deep scan, but its docs say these tools “cannot guarantee complete security” and recommend a professional review for sensitive apps. In February 2026, The Register reported that an app showcased by Lovable exposed data on 18,697 users through missing access controls, and Lovable said its scan recommendations had not been implemented. In April 2026, Lovable confirmed a backend regression that had exposed the chats and source code of public projects for about 11 weeks, and it then made existing public projects private. As guidance, check generated access rules yourself and treat project visibility settings as security settings.

Lovable Review (2026): Is the Full-Stack AI App Builder Worth It for Developers?