Lovable Security & Data Access Checklist

Look forEnable row-level security with restrictive conditions on every table holding private data. Lovable's Supabase docs identify missing policies as the most common exposure. Matt Palmer found inadequate policies on 303 endpoints across 170 of 1,645 apps in Lovable Launched.

Look forCheck project visibility separately from website access. Project visibility controls the editor and code, plus chat. From February 3 to April 20, 2026, any Lovable user with a link could read public projects' chats and code. Lovable fixed the regression within two hours of the public report and made historic public projects private. Lovable says private projects and Cloud were unaffected.

Look forRestrict published apps to invited people on any plan or workspace members and groups on Business and Enterprise. Every plan otherwise defaults to anyone with the link. Enterprise can restrict who publishes externally.

Look forBusiness and Enterprise exclude workspace data from training by default. Since September 9, 2026, Free and Pro data may be used for training unless each user opts out, and opting out does not remove content from training sets assembled earlier. Move builders who handle company data onto Business. End-user submissions to your apps are excluded. Enterprise uses only zero-data-retention models unless an admin enables extended retention.

Look forOIDC or SAML SSO comes with Business and Enterprise. Business creates accounts on first sign-in. Enterprise adds SCIM and two-factor enforcement, plus invitation limits. Enterprise audit logs stay in Lovable for 13 weeks. Since October 15, 2026, Enterprise admins can export them every hour or every 3 hours to Amazon S3, Google Cloud Storage, Azure Blob Storage, Splunk, or Azure Log Analytics.

Look forEach publish checks row-level security and permissive access, plus leaked-password protection and npm dependencies. Request a free deep scan for authorization and injection, plus secrets, payments, and personal-data exposure. Wiz and Aikido connectors add checks. Enable blocking for critical issues, which is off by default except on new Enterprise workspaces. Lovable's docs say the scans do not replace a security review.

Look forLovable is not HIPAA compliant and signs no business associate agreements, so keep health data out. It holds SOC 2 Type II and ISO 27001:2022, plus AIUC-1. Cloud data stays in the region chosen at setup, in the Americas, Europe, or Asia Pacific. EU model inference requires Enterprise. Deploy on AWS and Deploy on Azure, which run apps and their data in your own cloud account, are open to Enterprise teams by invitation through the account team (October 20, 2026).