Lovable Review 2026

Bottom line

Lovable is a natural-language, full-stack web application builder aimed at going from idea to deployable app quickly. Its differentiators are editable code, a built-in Cloud backend, native hosting, workspace collaboration, increasingly broad connectors, GitHub/GitLab sync, and an MCP server that lets external AI clients operate Lovable projects.

The principal buyer trade-off is economic and operational: one shared credit balance now pays for building, hosting/backend runtime, and AI features inside deployed apps. That makes usage transparent in one place, but it can also make a credit shortfall a production availability incident.

Verified primary sources

• Homepage: https://lovable.dev/
• Pricing: https://lovable.dev/pricing
• Product overview/docs: https://docs.lovable.dev/introduction/welcome
• Credits and usage: https://docs.lovable.dev/introduction/credits-and-usage
• Connectors overview: https://docs.lovable.dev/integrations/introduction
• Git sync: https://docs.lovable.dev/integrations/git-sync-overview
• Hosting: https://docs.lovable.dev/features/hosting
• Security marketing page: https://lovable.dev/security
• Connector security: https://docs.lovable.dev/integrations/security
• Lovable MCP server: https://docs.lovable.dev/integrations/lovable-mcp-server
• Changelog/product announcements: https://docs.lovable.dev/changelog
• Trust Center: https://trust.lovable.dev/
  • The Trust Center URL resolved and identified itself as “Trust Center,” but its report content did not render in the research browser. Buyers should request the actual reports/attestations directly.

What Lovable can do

Core product capabilities

Official documentation describes Lovable as a full-stack AI development platform that generates and edits real code through natural-language interaction. A project can include:

• Frontend UI
• Built-in backend, Lovable Cloud
• Database, authentication, storage, edge functions, realtime capabilities
• Integrations and API calls
• AI features in the deployed application
• Publishable, globally delivered web apps with HTTPS
• Editable code, code download on paid plans, and Git sync

It is positioned for MVPs, SaaS dashboards, internal tools, customer-facing web apps, marketplaces, e-commerce, marketing sites, educational tools, and simple browser games. Treat “production-grade” as Lovable’s positioning, not a substitute for engineering review, threat modeling, accessibility, performance, or acceptance testing.

Deployment and hosting

• Publishing creates a live app and Lovable manages hosting and HTTPS.
• lovable.app publishing is free on all plans. Custom domains require a paid plan.
• Business and Enterprise add branded workspace URLs.
• Lovable says plans do not cap visitors, requests, or bandwidth; runtime resource usage still consumes credits.
• Apps created from 13 May 2026 use server-side rendering, according to the hosting docs. Older React/Vite projects may be upgraded to TanStack Start.
• Published sites are public-by-link by default. Business and Enterprise can restrict access to workspace members, specified people, or groups.

Code ownership and portability

• GitHub and GitLab sync is automatic and two-way: Lovable changes are committed to the connected repository, and commits to the synced branch return to Lovable.
• Paid users can download a codebase without Git sync.
• Documented Git limitations matter:
  • No import of an existing repository into Lovable. Connecting creates a new repository.
  • One repository per Lovable project.
  • One synced branch flows back into Lovable.
  • Renaming, moving, or deleting the connected repository breaks sync.
  • Reconnecting creates a new repository rather than re-linking the old one.

Integrations and action surfaces

Lovable documents four useful integration patterns:

1. App + chat connector: a shared connection that the published app can call, and Lovable can use while building.
2. Chat connector / MCP server: personal context for the builder, not exposed to the published app.
3. App-user connector: each end user authorizes their own account; the app acts with that user’s permissions.
4. Any API / custom MCP: Lovable can generate an API integration or consume a custom MCP server when the catalog lacks a connector.

The catalog includes examples across productivity, CRM, analytics, data warehouse, payments, e-commerce, and developer tools: Slack, Notion, HubSpot, Google Workspace, Stripe, Supabase, GitHub, GitLab, Salesforce, Shopify, PostHog, BigQuery, Snowflake, ClickHouse, Redshift, Microsoft Fabric, Xero, Pipedrive, and others. Do not equate catalog presence with equal depth or two-way capabilities. Check the specific connector’s scopes, authentication pattern, gateway status, and write permissions.

Lovable as an MCP action surface

Lovable exposes an MCP server at https://mcp.lovable.dev. Its docs say an external AI client can create projects, message the Lovable agent, inspect code, deploy apps, access Cloud/database functions, connectors, analytics, and file uploads.

The current OAuth-supported client list is:

• ChatGPT
• Claude / Claude Desktop
• Claude Code
• Cursor
• VS Code

This is available on all plans. The changelog also includes a “Lovable MCP is now a Codex plugin” announcement, while the current MCP page’s OAuth list does not name Codex. This may reflect a separate connection method rather than an error, but buyers relying on Codex should require written confirmation of the supported setup, permissions, and authentication path.

Current pricing and usage limits

Source: Pricing and Credits and usage, checked 30 July 2026.

Credit selector: Pro and Business public selectors currently scale from 100 to 10,000 credits per month. The annual selector displayed Pro starting at $21/month for 100 credits and Business at $42/month for 100 credits. Recheck the live selector/checkout before publication because pricing is dynamic by selected volume.

Included grants and meaningful limits

• Free: 5 daily build credits, capped at 30/month; 20 Cloud credits/month; 4 AI credits/month.
• Pro and Business: 5 daily build credits; 20 Cloud credits/month; 4 AI credits/month.
• Lovable labels the Cloud and AI grants as a temporary offering subject to change.
• Plan mode: one message costs one credit and does not alter code.
• Build mode: variable consumption based on scope and work performed. Lovable’s examples range from 0.50 credit for a small style edit to 2 credits for a landing page with generated images; these are illustrative, not a fixed rate card.
• One balance now covers:
  • Build messages
  • Cloud hosting/backend: database, network, storage, compute, realtime
  • AI gateway/model calls made by the deployed app

Overages, expiry, and downtime mechanics

• Pro top-ups: $15 per 50 credits, or $0.30/credit.
• Business top-ups: $30 per 50 credits, or $0.60/credit.
• Paid plan credits roll over while the subscription remains active. Monthly-plan credits expire two months from issue; annual-plan credits expire one month after the annual period ends. Purchased top-up credits are valid for 12 months.
• Auto top-up is available to paid-plan admins/owners. Defaults shown in docs: 100-credit top-up, 25-credit threshold, 400-credit monthly limit. Buyers can select larger limits, including no limit.
• When the balance reaches zero:
  • Building stops.
  • Deployed app AI features stop.
  • Built-in backend services, including database/storage/auth-dependent functions, pause shortly thereafter.

Practical implication: Pro’s lower top-up rate makes it cheaper per emergency credit than Business, despite Business’ governance features. Model a full workload, including runtime Cloud and AI, rather than treating credits only as authoring prompts.

Governance and security facts

Vendor-stated compliance and privacy

Lovable states it has:

• SOC 2 Type II
• ISO 27001:2022
• GDPR compliance/supporting controls
• DPA, privacy policy, and terms

It also states that customer prompts, source code, and workspace data are not used to train Lovable models, and that agreements with AI providers restrict training and retention. Request the DPA, subprocessor list, scope of the ISO/SOC reports, report period, exclusions, and data-flow diagrams during procurement.

Identity, permissions, and publishing

• 2FA, workspace roles, SAML/OIDC SSO, and SCIM are documented.
• Security page names Okta, Azure AD, and Google as supported SAML/OIDC providers.
• Editing, approval, and publishing are distinct permissions. Lovable says enforcement is server-side.
• Enterprise pricing includes audit logs; do not assume audit logging is available at lower tiers.
• Business includes SSO. Enterprise includes SCIM.
• Cloud data residency is stated for EU, US, and Australia; Lovable says customer data remains in its selected region by default.

App and platform safeguards

Lovable says:

• Secrets are encrypted at rest and role-controlled.
• A basic security scan runs every publish, checking database configurations, RLS, Cloud settings, and known misconfigurations in roughly 10-15 seconds.
• A deeper scan can be run on demand, with a stated approximate three-minute duration.
• Business and Enterprise can schedule recurring deep scans.
• Admins can enable auto-fix for non-breaking findings and block publication on critical findings.
• Dependency checks run continuously.
• Lovable Cloud has WAF controls, network isolation, encrypted storage, and adaptive rate limiting.

These controls are useful safeguards, but should not be presented as an independent application penetration test or a guarantee that generated code has no business-logic, authorization, supply-chain, or privacy defects.

Connector-specific security and limits

For most gateway-based app + chat connectors, Lovable documents:

• Encrypted stored tokens that workspace members, admins, and the Lovable agent cannot read back directly.
• A connector gateway that retrieves third-party data live.
• Access mirrors the authorization of the account that established the connection.
• Deleting a connection immediately removes its secrets and stops apps using it.
• OAuth token refresh managed by the gateway.
• Stable outbound IP ranges for allowlisting.
• 1,000 requests per minute per connector per project.

Important exception: non-gateway connectors may use different authentication methods, and certain public or non-gateway secrets can be visible in a project and to the agent. Confirm gateway status and secret exposure for every sensitive connector.

Recent official product signals

The official changelog indicates a high release cadence. Relevant late-July announcements include:

• 29 July 2026: Amazon Redshift and Microsoft Fabric app + chat connectors; reduced false positives in dependency scans.
• 28 July 2026: Google Analytics and Xero connectors; one-click Pipedrive connection; migration path for older projects to TanStack Start.
• Other recent entries include PostHog integration, per-action connector approvals, user-owned app connections, recurring security scan policy selection, and expanded AI model options for an app’s runtime AI features.

Use this as evidence of product momentum, not a promise of roadmap stability.

Buyer questions to put in the review

1. What did a comparable project consume in build, Cloud, and runtime AI credits over 30-90 days? Ask for a usage export or run a paid proof of concept.
2. What exact event happens to our live app when credits run out? Test backend, auth, storage, and user-facing AI flows rather than relying on documentation alone.
3. Can we cap or approve auto top-ups by workspace, project, group, and person? Clarify the financial-control model and ownership workflow.
4. Which Business/Enterprise features are required for our SSO, SCIM, audit-log, internal-publishing, and external-sharing requirements?
5. Which data is in Lovable Cloud versus our Supabase/external stack, and which region applies to each?
6. Can the vendor provide current SOC 2 Type II and ISO 27001 reports, DPA, subprocessor list, incident-notification terms, retention/deletion commitments, and penetration-test scope?
7. Which of our connector integrations use the secure gateway, what scopes do they receive, and are they read-only or write-capable?
8. Does a 1,000 RPM per-connector/per-project limit fit our peak workload and background automation?
9. Can our developers maintain the code independently through GitHub/GitLab, CI/CD, code review, and external deployment?
10. How will we migrate an existing codebase? Lovable’s documented Git sync does not import existing repositories.
11. What is the supported Codex integration path? The current MCP OAuth client list and Codex-plugin changelog entry need reconciliation.
12. What end-to-end QA gates will we apply before publishing generated code? Include authorization/RLS, secrets, accessibility, performance, analytics consent, and rollback testing.

Review-worthy red flags

• Credit pooling couples creation and production runtime. An exhausted balance can pause backend services and disable deployed-app AI.
• Consumption is partly variable. Build-mode pricing depends on task scope and agent work; the provided examples are not a predictable fixed price.
• Temporary Cloud/AI grants may change. Do not calculate TCO on free included runtime grants alone.
• Auto top-up can create surprise spend if thresholds and monthly ceilings are not deliberately administered.
• Public-by-link is the default publishing behavior. Restricting visitors needs Business or Enterprise controls.
• Git portability has a material limitation: no repository import, single repo/project, one sync branch, and reconnection creates a new repo.
• Connector security is not uniform. Most use the gateway, but not all; non-gateway handling can differ.
• Security scanning is an assistive control, not an app-security certification.
• Trust-center reports were not publicly inspectable in this research session. Request evidence rather than relying on badges.
• The unified credit model is rolling out gradually. Some workspaces may still display the older Cloud/AI-balance experience, so confirm the workspace’s actual billing model.

Realistic alternatives

Editorial positioning

Lovable is strongest for teams that value a prompt-first path to a hosted web application but still want editable code, Git-backed escape routes, external integrations, and enterprise controls. It is less attractive where an existing codebase must be imported, where zero-downtime operation cannot depend on a shared credit balance, or where procurement requires public verification of every security attestation before a proof of concept.