Lovable capabilities

Lovable runs automated security scans — a Basic scan (RLS policy linting, database schema review, dependency audit) and a more thorough Deep scan (access-control review, backend endpoint protection, code-level vulnerabilities, project-specific issues) — that catch misconfigured access controls, code vulnerabilities, and known npm CVEs before publishing.

Build Mode is Lovable's autonomous execution environment that takes end-to-end ownership of a task: exploring the codebase, applying changes across multiple files, inspecting logs and network activity, running browser tests, fetching external documentation, and iterating until issues are resolved.

Lovable supports multi-user collaboration at both project level (invite specific collaborators to one project) and workspace level (invite teammates to all workspace projects). Role-based permissions control editing, publishing, admin, and ownership rights.

Lovable uses a credit system where AI actions (chat messages, Build Mode tasks) consume variable credits based on complexity. Plans tier from Free through Pro, Business, and Enterprise with increasing monthly credit allotments and unlocked features.

Lovable converts Figma designs into functional full-stack applications via the Builder.io Visual Copilot Figma plugin. The plugin exports a design to code, which then opens directly in Lovable for backend wiring and further AI editing.

Lovable generates complete web applications from a natural-language prompt, producing React/Tailwind front-end code plus optional Supabase backend wiring in one step. Users describe an app, upload screenshots or docs, and a working prototype appears in real-time.

Lovable hosts published apps at lovable.app subdomains with one click; paid plans add custom domains and badge removal. Each publish deploys a snapshot — updates require manual republish.

Security memory is a dedicated per-project document that Lovable's security scanner reads before each scan, letting teams record their access-control model, business-logic rules, and risks already reviewed and accepted so future Basic and Deep scans focus on new or unresolved issues instead of re-flagging the same findings.

Subagents are autonomous helper agents that Lovable's main build agent spins up automatically to run research and exploration work in parallel while it keeps building the app. The main agent acts as coordinator and delegates subtasks - exploring the codebase, researching features or best practices on the web, debugging performance across connected systems, and planning before implementation - to multiple subagents that run at the same time and report findings back. Subagents are read-only: they investigate but cannot change your code, so the main agent stays in control of edits. The result is less context-switching and faster, deeper builds.

Lovable integrates with Supabase to provide a managed backend encompassing PostgreSQL database, authentication (email/password and OAuth providers), file storage, edge functions, and real-time subscriptions — all configurable through Lovable's chat interface.

Lovable provides a library of production-ready, officially curated remixable templates (community-built) covering apps (SaaS, internal tools, project management), websites (portfolios, landing pages, e-commerce), and specialized categories (events, music, weddings, editorial). Users fork a template as a new project and customize from there.

Lovable projects sync bidirectionally with GitHub repositories: changes made in Lovable auto-push to the connected branch, and commits pushed externally sync back into Lovable, enabling developers to use their own IDE alongside Lovable.

Lovable's visual editor (now called the preview toolbar) lets users select, edit, annotate, and comment directly on the live app preview — clicking any element to modify it without writing a prompt. Supports inline text editing, element selection with annotation, and image attachment.

Workspace Insights is a Security Center view that lets Enterprise workspace admins and owners see every project in the workspace from one place, combining security findings, PII findings, ownership, lifecycle, cost, publish status, and activity into a single review priority (High, Medium, Low, or Not scanned) per project.