What Lovable is good at
- Its built-in Cloud covers hosting, database, storage and realtime features, so a first version runs without separate setup.
- It offers a quick security scan and a deep scan that looks for unauthenticated endpoints, leaked secrets and exposed data.
- It spots API keys pasted into the chat and steers you to store them in Secrets instead.
Where Lovable breaks
- Data access rules are wrong: CVE-2025-48757 found 170+ Lovable apps with missing or weak Supabase row level security, exposing user data and API keys to anyone with the public key.
- Credits run out: building stops, AI features in the deployed app stop working, and apps on the built-in backend can pause until you top up.
- You need guaranteed security: Lovable's own docs say its scans cannot guarantee complete security and that you must review RLS policies yourself before publishing.
When a custom build beats Lovable
Once real users, payments or private data are involved and you need someone accountable for auth, access rules and a data model that will hold up.
Setup
No-code. Someone comfortable with spreadsheets can set it up. No code needed.
Sources
- lovable.dev/pricing
- docs.lovable.dev/introduction/plans-and-credits
- docs.lovable.dev/features/security
- superblocks.com/blog/lovable-vulnerabilities
- docs.lovable.dev/introduction/subscription-plans
Price checked 9 Oct 2026. If something here is out of date, email indra@kratuva.com and we will fix it.
