Lovable review (2026): features, credits and security checks

Lovable is an AI app builder that turns chat prompts into websites and web apps, priced by credits rather than seats, with two built-in security scans. It's fast for first versions, and like any builder, the settings you leave on or off at launch are yours to control. This review covers how it works, how credits work and what to check before you publish.

By Gary, Greenlight · Last checked: Oct 19, 2026 · Based on Lovable's own pricing page (external) and security docs (external). We're not affiliated with Lovable and weren't paid for this review.

What Lovable is

Lovable's pricing page describes it as "an AI software engineer, which enables anyone to build for the web": you chat, and it builds websites and web apps. Per the same page, you own the code and projects you build (subject to any third-party rights in the underlying AI models).

How Lovable credits work

Lovable prices by credits, not seats. Workspaces support unlimited members on all plans and share one credit pool. From Lovable's pricing page (external), as of Oct 19, 2026:

• Free plan: a daily grant of 5 build credits (up to 30 a month), plus 20 Cloud credits a month.
• Paid plans include a monthly credit balance on top of daily grants.
• Plan Mode costs 1 credit per message; Default Mode varies with task complexity.
• Example costs Lovable lists: "Make the button gray" 0.50 credits; "Remove the footer" 0.90; "Add authentication with sign up and login" 1.20; "Build me a landing page, use images" 1.70.
• Expiry: unused monthly plan credits expire two months after they're issued; top-up credits last 12 months; daily build credits don't roll over.

Worked example: on the free plan, 30 build credits a month at Lovable's example rate of 1.20 credits for adding sign-up and login is about 25 changes of that size (30 ÷ 1.20 = 25). Real costs vary with each prompt. For plan prices, see Lovable's pricing page.

What Lovable does well

• Speed to a first version: a working app from a prompt.
• One place for build, hosting and data.
• Team-friendly pricing: no per-seat charge.
• Security tooling built in (below).

Things to weigh

• Credits can be hard to predict, since Default Mode cost depends on the task.
• Generated code still needs review for logins, data rules and payments. Lovable's docs say its scans "do not replace a thorough security review."
• Credits aren't refundable, per the pricing page.

Lovable's built-in security features

Per Lovable's security docs (external):

• Quick scan runs automatically every time you publish. It checks database access rules and settings (for example, tables without row-level security and leaked-password protection turned off), npm dependencies with known vulnerabilities, and MCP servers exposed without authentication.
• Deep scan runs on demand and reviews your app's code for issues such as access control, unauthenticated endpoints, unsafe input and injection, leaked secrets, and payment logic.
• API key protection: Lovable detects API keys pasted into the project chat and guides you to store them in Secrets instead of hardcoding them.
• Leaked password protection can be enabled for email and password sign-in, to reject known compromised passwords.
• Publishing controls: workspace admins can block publishing while critical findings are unresolved.

Lovable's docs are clear that these tools "cannot guarantee complete security" and that you're responsible for your app's security, especially if it handles sensitive data.

Before you launch a Lovable app

These are settings the app's builder controls:

1. Run the Quick scan and a Deep scan, and fix Critical findings.
2. Check that RLS is on for every table with private data (what Supabase RLS is), then test with two of your own accounts.
3. Keep secrets in Secrets, never in frontend code. The Supabase anon key is public by design; a service role key isn't (rotate it if it leaked).
4. Turn on leaked password protection if you use email and password sign-in.
5. Check the live site from outside: HTTPS, security headers, and no public .env, .git or source maps.

New to the idea? See what vibe coding is.

Verdict

Lovable is built for getting from idea to working app quickly, and it includes built-in security scans and API key protection. Whether it fits depends on how predictable you need costs to be and how much you'll review the generated code. Whatever you build with, check the launch settings yourself.

FAQ

Is Lovable free? There's a free plan with 5 daily build credits (up to 30 a month) and 20 monthly Cloud credits, per Lovable's pricing page as of Oct 19, 2026.

Is Lovable safe to use for a real app? It includes security scans and API key protection, and its docs say you're still responsible for your app's security. Check RLS, secrets and your live site's settings before launch.

Do I own the code Lovable builds? Lovable's pricing page says you own your code, projects and AI output, subject to any third-party rights in the underlying models.

How many credits does a Lovable prompt use? Plan Mode is 1 credit per message; Default Mode varies. Lovable's examples range from 0.50 to 1.70 credits.

Does Lovable charge per user? No. Plans are priced by credits, with unlimited workspace members.

What does Greenlight's free scan check? From the outside only: HTTPS, security headers, exposed .env and .git files, public source maps, and secret keys in your homepage's scripts. If it finds a Supabase project and its public key there, it counts which tables return rows to that public key (it reads no row data). It doesn't log into your builder or Supabase, read your code repository or RLS policies, or test logins and app logic. It's educational, not a security audit, and "nothing found" isn't a guarantee.