www.linkedin.com
90% of apps built with Lovable will fail
After shipping 50+ apps in 6 months: 45 dead, 5 thriving. A founder's brutal breakdown of what actually survives on the platform.
Lovable: The $6.6 Billion "Anyone Can Build Apps" Promise That Bills You Into Oblivion
Lovable raised $330M at a $6.6B valuation promising to empower "the 99%" to build apps without coding. Reality: a credit system that burns through $20 in two days debugging AI sidebar loops, 90% app failure rate from an independent who built 50+, a $13K–$38K hidden infrastructure bill per app, and a CVSS 9.3 security vulnerability that could expose your users' data. The code is yours. The rest is on you.
Somewhere in a medium-sized conference room, a product manager saw the Lovable demo and made a slide that said "idea to app in seconds." That slide made it to the board deck. The board loved it. Nobody asked what happens after the second.
That's the whole story, really. But since you came here for the teardown, let's get into it.
The pitch
Lovable launched as GPT Engineer — an open-source GitHub project that went viral because developers thought it was neat. Then it rebranded to Lovable in late 2024 to shed the "developer tooling" identity and go after a much bigger market: everyone who's ever had a business idea and couldn't build it.
The new pitch is a masterpiece of aspirational copy 1:
"We launched Lovable to empower the 99% — the people who've had ideas but lacked the technical skills to bring them to life."
That's a noble framing. It implies that the only thing standing between a nurse and a working healthcare app was a coding barrier that Lovable just dissolved. The marketing goes further: "Build apps by chatting with an AI." "Idea to app in seconds." "No coding required."
And the numbers they put behind it are designed to make you believe this is already working at scale. 100,000 new projects per day. 25 million total projects created in the first year. 8 million registered users. $300M+ ARR in under 12 months — one of the fastest revenue growth stories in the history of software companies. Half a billion visits to Lovable-built websites in six months 1.
Investors heard all of this, nodded, and wrote checks. Enormous ones.
In December 2025, Lovable closed a $330 million Series B at a $6.6 billion valuation 1. Led by CapitalG (Google's growth fund) and Menlo Ventures. Joined by NVIDIA, Salesforce Ventures, Databricks Ventures, Atlassian Ventures, HubSpot Ventures, Khosla Ventures, and — because 2025 was that kind of year — Gwyneth Paltrow's Kinship Ventures. Total funding reached $653 million from 39 investors. The valuation tripled in five months.
Forbes named it the fastest-growing startup. TechZine called it a Swedish miracle.
That's the pitch.
The credit problem nobody puts in the demo
Here's what Lovable does not include in its "idea to app in seconds" video: a clock showing how fast you run out of credits.
Lovable runs on a credit system. Free tier: 5 credits per day, enough for roughly 3 interactions before the meter hits zero. The $20/month Starter plan gives you 100 credits per month. The $50/month Launch plan: 500 credits. The $100/month Scale plan: 1,500 credits. No pay-as-you-go option exists. Unused credits don't roll over beyond the monthly cap 2.
This sounds manageable until you try to build anything that isn't a landing page with a contact form.
Users rebuilding the same sidebar have watched $20 disappear in two days:
"Burned through my entire Starter plan in 2 days trying to get a simple dashboard layout right. The AI kept breaking the sidebar every time I asked it to fix the header. $20 gone." 2
This is the core mechanical failure. Lovable's AI enters fix loops — it modifies element A to satisfy your request, breaks element B in the process, you ask it to fix B, it breaks A again. Each loop costs credits. You're paying per iteration of an infinite loop you didn't start.
"Still unreliable. UI glitches? Still ignored. Dropdowns? Buggy & inconsistent. And the worst part? No response to my complaint email..."
"A simple sign up / sign in logic and visual building have so much flaws and spending almost 40 credits no resolution still. No proper support..."
"Image uploading has been brutal with issues. I signed up for Supabase because it told me to. Now bugs and hiccups as I get close to trying to finalize."
The 2026 version of this: a Reddit post titled "Lovable apps breaking left and right in 2026" documented dozens of projects failing after the platform rolled out updates, with changes not deploying to production and analytics stopping mid-stream 5. One user found that regardless of how many changes they made to code, the deployed production environment kept serving an old version. The preview showed the right app. The live URL showed something else.
This is not an edge case. It's the product's behavior under normal usage.
What "full-stack" actually means here
The marketing says Lovable builds "full-stack" applications. Technically this is accurate in a way that requires a footnote the size of a terms-of-service document.
What you get from Lovable is React and TypeScript frontend code, a Supabase database schema, authentication scaffolding, and API route structures 2. What you do not get: a database that's actually deployed. Production environment setup. AI capabilities inside the app. Automation workflows. Email. File storage. Monitoring. Security hardening. Scaling infrastructure. Maintenance.
An independent breakdown of what it actually takes to get a "Lovable-built" moderately complex business app running in production found the following 2:
- 38–66 hours of post-generation development work (database setup, hosting, authentication, integrations, email, error tracking)
- $166/month in infrastructure (Supabase, Vercel, SendGrid, OpenAI, Sentry, file storage)
- Developer cost: $3,800–$13,200 one-time for the integration work
- Year 1 total per app: $13,000–$38,000
You are paying $20/month for the privilege of generating a blueprint that will cost you $13,000 to turn into a building.
Lovable's own announcement describes this setup favorably: "Infrastructure to take products from prototype to production." A more accurate description would be "you handle infrastructure." The product generates code. The gap between generated code and a deployed working application is your problem.
Jacob Klug, who shipped 50+ apps on Lovable over six months, put it bluntly 6:
"Of our 50+ apps — Thriving (5): agency reporting dashboard, dental inventory manager, contractor invoicing tool, local business review collector, email warmup service. Dead on arrival (45): every AI wrapper we built, all the 'productivity' apps, the 'social' experiments, anything we built 'because it'd be cool.'"
Loading link preview…
A 10% survival rate. The other 90% are code sitting in a Supabase project that nobody is deploying or maintaining, counting toward Lovable's "25 million total projects" number.
The part about what model it's running on
Here's the catch that nobody in the pitch deck mentions: Lovable is not running a proprietary AI model. It's a wrapper. The AI that "builds your app" is a large language model from one of the foundational providers — the same GPT-4 class or Claude class models you could access yourself through an API, without the credit metering.
One commenter summarized this in a Medium piece tracking the platform's reliability problems 7:
"Lovable is essentially a full-stack, vibe-driven coding tool, but it completely depends on a single AI model, runs on a credit payment system, and ultimately charges customers for the cost of the underlying LLM."
The business model, stripped of the "age of the builder" framing, is: Lovable licenses an LLM, adds a web interface, charges you credits to access it, and pockets the margin between what you pay and what the API call costs. The 8 million registered users and $300M ARR suggest this margin is enormous.
The product moat — the thing that justifies a $6.6 billion valuation — is not a proprietary model. It's a UI and a community and some convenient Supabase defaults. That moat is navigable in an afternoon by any developer who'd rather just call the Claude API directly.
The security part that doesn't make the launch announcement
Vibe coding platforms have a structural security problem, and Lovable has documented evidence of being inside it.
Loading link preview…
Escape.tech scanned 1,400 applications built on vibe coding platforms and found 2,038 critical vulnerabilities, over 400 leaked API keys, and 175 instances of exposed personally identifiable information including medical records, financial data, and authentication credentials 8.
Specifically for Lovable: CVE-2025-48757 (CVSS score: 9.3 — rated "Critical") was a row-level security bypass vulnerability in Lovable-generated Supabase code that allowed users to access other users' data 8.
Veracode's testing of 100+ large language models found that 45% of AI-generated code samples introduce OWASP Top 10 vulnerabilities, with Java code failing at a 72% rate, 86% of samples lacking cross-site scripting protection, and 88% vulnerable to log injection 8.
The AI-generated code security situation, according to a Fortune 50 enterprise study cited in the same research: AI-assisted developers commit code 3–4x faster than their peers but introduce security findings at 10x the rate. Privilege escalation paths increased 322%. Architectural design flaws increased 153% 8.
The nurse who built the patient journey app that Lovable proudly featured in their Series B announcement — if they deployed it using Lovable's generated Supabase configuration, it may well have been exposing other patients' records under a CVSS 9.3 vulnerability that was actively in the codebase.
Lovable has since added Wiz security scanning. They also hired a security-focused software engineer. These are good developments. They're also things a company with a $6.6 billion valuation probably should have had before declaring itself ready for enterprise healthcare deployments.
Loading link preview…
The verdict
What Lovable actually is: a well-designed, genuinely functional web interface that wraps a third-party LLM and generates decent React/TypeScript/Supabase scaffolding. It is useful for prototyping. It is, by its own founder's documented data, not useful for 90% of the apps people build on it. It is categorically not ready for production without significant additional development work, infrastructure setup, and security review — which costs between $13,000 and $38,000 in year one.
What Lovable is sold as: the death of the coding barrier. The age of the builder. The tool that turns a nurse's idea into a healthcare app and a founder's napkin sketch into a product. Something worth $6.6 billion.
The gap between those two things is what you're being asked to fund at a valuation that assumes 8 million people will keep paying $20 to $100 per month to burn through credits debugging AI-generated sidebar code.
The companies that featured in the Series B announcement — Klarna, Deutsche Telekom, Uber AI — are using Lovable for internal prototypes and stakeholder alignment demos. Rapid ideation. Time-boxed sprints. These are real use cases. They are not "shipping real products in production." They are "making slides interactive before the engineering team builds the actual thing."
That is a useful product. That is not a $6.6 billion product. And it is very much not "empowering the 99%," unless those 99% are product managers at Fortune 500 companies who need a better way to demo concepts.
For everyone else, the math is what it is. The free tier runs out in three prompts. The paid plan runs out in two days. The infrastructure bill arrives separately. The security vulnerabilities come standard.
At least the code is yours to keep.
References
- 1Lovable Series B announcement
- 2Lovable Review 2026: Worth It or Credit Trap?
- 3Getting so frustrated with Lovable
- 4LOVABLE APP — UNACCEPTABLE BUGS & ZERO SUPPORT
- 5Lovable apps breaking left and right in 2026
- 6Why 90% of apps built with Lovable will fail
- 7Lovable is Doomed — Forbes' fastest-growing startup is burning through user trust faster than credits
- 8Vibe Coding's Security Debt: The AI-Generated CVE Surge
Add more perspectives or context around this Drop.