Lovable: a vibe-coding app builder that says it hit $100M ARR 8 months after its first $1M

Q: Why did Lovable work?

It served people who can't code. "Most of Lovable's traction seems to come from non-technical users, who use it to create prototypes" (TechCrunch). It removed the backend wall. The Supabase integration let users build "full-stack apps (complete with auth, db, storage, edge functions) without leaving our editor" (Show HN). It engineered around model failures. The founder's pitch was mapping "where LLMs fail in full-stack dev and engineering around those pitfalls with prompt chains" (Show HN).

Q: What can indie builders learn from Lovable?

An old project can be the base for a new wave. Lovable grew out of GPT Engineer rather than starting from zero (Lovable). If you build on Lovable, treat security as your job. Enable and test Row Level Security on every table before you ship (Matt Palmer, CVE-2025-48757). Know what your users really make. The company says most use is prototyping (TechCrunch); a prototype tool and a production platform need different features.

Q: What didn't work for Lovable, and what are the risks?

Generated apps leaked data. CVE-2025-48757 covers Lovable projects deployed with "insufficient Row Level Security (RLS) policies", which could expose PII and API keys to unauthenticated attackers; it affects projects created on or before 15 April 2025 and may affect later ones (Matt Palmer). The researcher worked at Replit, a competitor (Matt Palmer). Pricing changes cost revenue. Osika wrote that Lovable "lost $1.5 million ARR in a single day" after moving Team users to the cheaper Pro tier (TechCrunch). Company-reported numbers. ARR, users and project counts come from Lovable and its CEO; they are not audited. Free users make up most of the 2.3 million active users (TechCrunch). Enterprise is harder. TechCrunch notes "notable barriers and concerns around vibe coding among enterprises" (TechCrunch).

A Swedish team rebranded GPT Engineer as Lovable, a browser app builder for non-developers. Company-reported growth was extreme; so was the security lesson for the apps people built with it.

Product: Lovable
Founder: Anton Osika (CEO)
Launched: 2024-11
Model: Freemium subscription with message credits

Published November 1, 2026 · 2 min read · 6 sources

Key takeaways

Relaunched as Lovable on 21 Nov 2024 (previously gptengineer.app); company-reported $100M ARR by 23 July 2025, 8 months after its first $1M.
Most traction came from non-technical users building prototypes; 10 million+ projects created, according to the company.
A CVE showed apps built on it could expose user data through missing Row Level Security: generated code still needs a security review.

What it is

Lovable is an AI app and website builder: you describe what you want in plain language and it writes a full-stack web app, with a native Supabase integration for auth, database and storage (Show HN, Nov 2024). The CEO is Anton Osika (TechCrunch).

Timeline

21 Nov 2024: launches on Hacker News "as Lovable (previously gptengineer.app)", with a free tier (Show HN). The rebrand from GPT Engineer is described on its blog (Lovable).
Feb 2025: a $15 million pre-Series A; the company said it had $17 million ARR and 30,000 paying customers with "just $2 million spent" (TechCrunch).
17 Jul 2025: $200 million Series A at a $1.8 billion valuation; the CEO said 180,000+ paying subscribers and $75 million ARR in seven months (TechCrunch).
23 Jul 2025: "Lovable officially passed $100m in ARR - in just 8 months since our first $1M", with more than 10 million projects built (Lovable). It had 45 full-time employees at the time (TechCrunch).

Why it worked

It served people who can't code. "Most of Lovable's traction seems to come from non-technical users, who use it to create prototypes" (TechCrunch).
It removed the backend wall. The Supabase integration let users build "full-stack apps (complete with auth, db, storage, edge functions) without leaving our editor" (Show HN).
It engineered around model failures. The founder's pitch was mapping "where LLMs fail in full-stack dev and engineering around those pitfalls with prompt chains" (Show HN).

What to learn

An old project can be the base for a new wave. Lovable grew out of GPT Engineer rather than starting from zero (Lovable).
If you build on Lovable, treat security as your job. Enable and test Row Level Security on every table before you ship (Matt Palmer, CVE-2025-48757).
Know what your users really make. The company says most use is prototyping (TechCrunch); a prototype tool and a production platform need different features.

Risks and what didn't work

Generated apps leaked data. CVE-2025-48757 covers Lovable projects deployed with "insufficient Row Level Security (RLS) policies", which could expose PII and API keys to unauthenticated attackers; it affects projects created on or before 15 April 2025 and may affect later ones (Matt Palmer). The researcher worked at Replit, a competitor (Matt Palmer).
Pricing changes cost revenue. Osika wrote that Lovable "lost $1.5 million ARR in a single day" after moving Team users to the cheaper Pro tier (TechCrunch).
Company-reported numbers. ARR, users and project counts come from Lovable and its CEO; they are not audited. Free users make up most of the 2.3 million active users (TechCrunch).
Enterprise is harder. TechCrunch notes "notable barriers and concerns around vibe coding among enterprises" (TechCrunch).

FAQ

Short answers drawn from the sections above.

What is Lovable?

Why did Lovable work?

It served people who can't code. "Most of Lovable's traction seems to come from non-technical users, who use it to create prototypes" (TechCrunch).
It removed the backend wall. The Supabase integration let users build "full-stack apps (complete with auth, db, storage, edge functions) without leaving our editor" (Show HN).
It engineered around model failures. The founder's pitch was mapping "where LLMs fail in full-stack dev and engineering around those pitfalls with prompt chains" (Show HN).

What can indie builders learn from Lovable?

An old project can be the base for a new wave. Lovable grew out of GPT Engineer rather than starting from zero (Lovable).
If you build on Lovable, treat security as your job. Enable and test Row Level Security on every table before you ship (Matt Palmer, CVE-2025-48757).
Know what your users really make. The company says most use is prototyping (TechCrunch); a prototype tool and a production platform need different features.

What didn't work for Lovable, and what are the risks?

Generated apps leaked data. CVE-2025-48757 covers Lovable projects deployed with "insufficient Row Level Security (RLS) policies", which could expose PII and API keys to unauthenticated attackers; it affects projects created on or before 15 April 2025 and may affect later ones (Matt Palmer). The researcher worked at Replit, a competitor (Matt Palmer).
Pricing changes cost revenue. Osika wrote that Lovable "lost $1.5 million ARR in a single day" after moving Team users to the cheaper Pro tier (TechCrunch).
Company-reported numbers. ARR, users and project counts come from Lovable and its CEO; they are not audited. Free users make up most of the 2.3 million active users (TechCrunch).
Enterprise is harder. TechCrunch notes "notable barriers and concerns around vibe coding among enterprises" (TechCrunch).

Sources

Every link cited above, in order of first use.

1.Show HN, Nov 2024 (news.ycombinator.com)
2.TechCrunch (techcrunch.com)
3.Lovable (lovable.dev)
4.Lovable (lovable.dev)
5.TechCrunch (techcrunch.com)
6.Matt Palmer, CVE-2025-48757 (mattpalmer.io)

Related case studies

Builder.ai: a $1.5B 'AI app builder' that collapsed into insolvency

Builder.ai raised hundreds of millions to build apps with an AI assistant called Natasha. Former staff say humans did most of the work; restated revenue and a cash seizure ended it in May 2025.

aino-codecautionary

Developer tools5 sources · 2 min

Bolt.new: a near-dead dev-tools startup that reached ~$40M ARR in five months

StackBlitz spent seven years on in-browser dev environments, was close to shutting down, then launched an AI app builder on top of that tech in October 2024. Growth figures are founder-reported.

aivibe-codingpivot

Vibe-coded3 sources · 2 min

fly.pieter.com: a vibe-coded game that hit '$1M ARR' in 17 days, then $0

Pieter Levels built a browser flight simulator with AI and sold in-game ads and planes. The headline was $1M ARR in 17 days. The follow-up shows why one-off revenue is not ARR.

vibe-codingcursorgame