Lovable Vibe Coding Platform: Growth, Security Lapses, Rivals

What Lovable is

Lovable is one of the best-known names in "vibe coding," the practice of describing software in plain language and letting an AI system generate a working application. By spring 2026 the company was valued at $6.6 billion and reported roughly eight million users. 12 Its pitch goes further than mockups. Reviewers describe it as a full-stack code generator suited to MVPs and simple production apps. It can wire in Stripe payments, add databases and user authentication, debug code, and let users adjust layouts through a Figma-like visual editor. 5

That range is what separates it from lighter prototyping tools. Roundups of 2026's AI coding and prototyping software consistently list Lovable as a developer-oriented app generator, often alongside Vercel's v0. 17 One review notes that Lovable works best for people who can read, edit, and debug the code it produces, which makes the learning curve steeper for non-technical users than the marketing suggests. 5

The April 2026 security incident

The most important recent development is a security failure, and the company itself has acknowledged it.

On April 20, a security researcher publicly reported that data inside public Lovable projects could be reached by any authenticated user. Lovable says it shipped a fix within two hours. It also concedes that both the product and its initial public response "missed the mark." 11 The company traces the problem to a February 2026 backend regression, which reopened access to chat histories on public projects. That change undid protections Lovable had deliberately added between March and November 2025. From February 3 to April 20, anyone with a Lovable account and a project link could potentially view public projects' chat history and source code. Lovable stresses that private projects and Lovable Cloud were never affected. 11

The Next Web's account is harsher and puts the emphasis elsewhere. It describes the flaw as a broken object-level authorization (BOLA) vulnerability in Lovable's API. According to that report, the hole stayed open for 48 days after the company closed a bug bounty report without escalating it, and it exposed source code, database credentials, AI chat histories, and personal data from thousands of users. 12 The outlet calls it the third documented security incident in about two months. It frames the episode as a structural problem with vibe coding, citing estimates that up to 62% of AI-generated code contains vulnerabilities. 12

The two accounts largely agree on the mechanics but frame them differently. Lovable presents a regression it fixed quickly. The Next Web presents a triage failure, in which a warning was dismissed and an exposure was left open for weeks. The timelines also measure different things. Lovable's figure runs from the original regression, while the 48 days counts from the closed bug report. The overall exposure window was therefore longer than seven weeks.

The concern has spread across the sector. Vibe-coding news feeds now run guides on reviewing AI-built apps before deployment. These focus on authentication, credential access, and permissions, which are the same weaknesses at issue here. 10

Product momentum continues

The company has kept shipping despite the incident. In September 2026, Lovable added Anthropic's Opus 5.5 model and claimed it now builds apps in 57% fewer steps. 10 That fits a broader industry pattern. One analysis argues that the underlying AI is effectively commoditized because most tools draw on the same frontier models. On that view, the real differentiator is the workflow built around the model. 6

A crowded and converging market

Lovable's competitive pressure comes from two directions.

Design tools: Figma launched Make in May and made it generally available in July. One product commentator suggests it will be "good enough" for many teams simply because it sits inside a workflow they already use. 6 The same analysis concedes that Lovable, Bolt, and v0 still generate more complex applications and support more frameworks. 6 Designers on Reddit are less impressed with Make. They call its output generic and see little difference from Lovable, v0, or chatbots. 3 One user reported needing 160 to 170 prompts to finish a simple side-panel prototype while running into monthly prompt limits. 4 An agency comparison likewise found Make prone to forgetting earlier design decisions and limited to web output. 5

Developer agents: Professional coding tools are also moving toward Lovable's territory. Cursor 3.0 shipped in April 2026 with an agent-first interface. Augment, GitHub, and Replit all expanded autonomous agent features during the year. 2 Cursor's September updates let users start projects without a repository, preview cloud agents' live environments in the browser, and run coordinator agents triggered by Slack or schedules. It also cut agent token costs by 7%. 89 Each of these features narrows the gap between an IDE and a prompt-to-app builder.

The takeaway

Lovable has scale, a strong valuation, and a product that reviewers rate above design-native rivals for real full-stack work. Its main weakness is trust, not capability. As model quality evens out across competitors, a platform that hosts users' code, credentials, and data will be judged on how it handles security as much as on what it can build. The April response shows Lovable can patch a flaw quickly. The 48-day gap reported by The Next Web shows it still has to prove it can catch problems before outside researchers do.