Lovable
Lovable
One-line summary: The most-used vibe-coding tool for non-developer MVPs — generates production-quality React frontends with Supabase backend and Stripe baked in, credit-priced at $25/mo Pro. July 2026 CEO primary: 1M new projects/week, >50M apps, >700M visits/mo, $500M ARR as of May, 20 months in market.
What it is
An AI app builder targeting non-developers and founders prototyping fast. Takes natural-language descriptions and generates full React applications with an opinionated stack: React + Supabase + Stripe. Browser-based, no local setup.
Why it matters to this thread
Lovable is the dominant tier-4 tool in the ai-coding-tool-landscape-2026, and the bulk sample in vibe-coding-security research (~4,000 of 5,600 apps analyzed by Escape.tech were built on Lovable). Understanding its stack, limits, and failure modes is load-bearing for the vibe-coding tier picture.
July 2026 CEO primary (anton-osika on All-In)
Vintage 2026-07. First-party scale that the April 2026 landscape snapshot did not have:
- 1 million new projects every week; more than 50 million apps on the platform; more than 700 million visits/month to those apps. In market 20 months. anton-osika in 2026-07-15-podcast-all-in-podcast-former-intel-ceo-on-what-went-wrong-what-s-next.
- Users: ~20% technical / 80% non-technical ("4 out of 5"). Same source.
- ARR: "We reached 500 in May" — $500M, correcting Calacanis's on-air "$400 million" guess. Same source. Treat as founder-stated, not audited.
- Pricing confirmed by CEO: starts at $25; business plan $50. Same source. Matches the April 2026 table below.
- Multi-model routing, including open weights: "routed to the model that's both suitable … commercial frontier models from multiple vendors and increasingly it's open weight models"; Stockholm post-training / RL on the mistakes frontier models make for Lovable's harness. Same source. Direct operator evidence for llm-as-commodity-thesis.
- "Many engineers, they don't look at the code, they don't write code anymore." Same source. Capability claim — vintage 2026-07.
- Nenad / NARSA: replaced >10 internal tools, saving >$1M/year. Same source. See saaspocalypse-thesis.
- Speaker-mapping: AssemblyAI labeled Osika
E; line ~370 "We are, yes" (token burn) is Osika, mislabeled Pat Gelsinger — not attributed to Gelsinger.
Pricing (from 2026-04-21-autoresearch-vibe-coding-app-builders)
| Tier | Cost | Credits |
|---|---|---|
| Free | $0 | 5/day (capped at 30/month) |
| Pro | $25/mo (shared across unlimited users) | 100/mo + 5 daily top-up (up to 150/mo); on-demand top-ups available |
| Business | $50/mo (shared across unlimited users) | 100/mo; adds SSO, team workspace, role-based access, security center |
| Enterprise | Custom platform fee | Volume-based credits; dedicated support, SCIM, audit logs |
Credit economics:
- ~0.5 credits for a styling change
- ~1.2 credits for a complex feature
- 150–300 credits needed for a basic MVP
- Visual edits (color, font, spacing) consume zero credits — the one free-iteration affordance in the system
Architecture & stack
- Frontend: React (production-quality code, not prototype-only output).
- Backend: Supabase (authentication, database, storage). Non-optional — the platform is built around Supabase.
- Payments: Stripe integration baked in.
- Export: Projects are downloadable; GitHub connection available.
- Stack lock-in: Moderate — tied to Supabase for backend, but the code itself is portable.
Strengths
- Best UI output of the tier per multiple independent reviews.
- Fastest path to "looks like a real product" for non-developers.
- Authentication and payments pre-wired — standard SaaS requirements are handled out of the box.
- Predictable pricing relative to competitors — Visual edits being free reduces the "AI charges you to fix its own mistakes" feedback loop that plagues other tier-4 tools.
Weaknesses / concerns
- "Lovable is fundamentally frontend-focused" (MindStudio full-stack).
- Iteration degradation under complexity: "After a few back-and-forth prompts, generated code can start to drift. The context window fills up, and changes start clobbering each other."
- Backend ceiling: "If you need custom server-side logic, background jobs, complex business rules, or APIs that don't fit the Supabase model, you're going to hit friction" (Emergent.sh).
- Credit loop on debugging: Users report credits get consumed fixing bugs the AI itself introduced.
- No persistent spec / structured source of truth — "just a conversation history and generated code. When something breaks, debugging often means starting from scratch rather than tracing back through a defined structure."
Security posture
Per the Escape.tech security research, Lovable was the dominant sample (~4,000 apps) in a study finding 2,000+ vulnerabilities across 5,600+ vibe-coded apps. The dominant failure mode for Lovable-built apps is:
- Exposed Supabase anonymous JWT tokens in shipped JavaScript bundles (normal when RLS is properly configured; dangerous when RLS is misconfigured).
- Misconfigured Row-Level Security (RLS) policies turning the exposed token into effective full database access.
- PII exposed in samples: medical records, IBANs, phone numbers, emails.
The recommendation — "manually review auto-generated RLS policies" — is a non-trivial ask of Lovable's non-developer audience. See vibe-coding-security for the full picture.
When to use Lovable (from 2026-04-21-autoresearch-vibe-coding-app-builders)
- Non-developer building an MVP.
- Standard SaaS shape: auth + dashboard + CRUD + payments.
- Client demos (per the Medium platform-wars review).
- Fastest path to visible polished result.
When not to use Lovable
- Custom server-side logic that doesn't fit Supabase.
- Apps requiring large-scale refactoring across many components.
- Projects beyond ~15–20 components (code quality cliff).
- Anything where code-quality maintainability matters long-term.
Sources
- 2026-04-21-autoresearch-vibe-coding-app-builders
- 2026-07-15-podcast-all-in-podcast-former-intel-ceo-on-what-went-wrong-what-s-next