AI
Lovable, the AI app builder that turns a plain-language prompt into a working web app, says it now sees about 1 million new projects every week. Its June 2026 report, The Build Economy, counts more than 50 million projects built to date. TechCrunch reported in August 2026 that the company had reached $500 million in annualized revenue run rate in June and raised a $400 million Series C at a $13.3 billion valuation.
Those numbers are real signals of demand. As a CTO who reviews vibe-coded products before they go to production, my view is narrower: 1 million projects a week is 1 million acts of software creation, not 1 million startups. And the gap between the two is where most of the risk sits, in the market and in security.
What do people build with Lovable?
Lovable's report draws on product usage data from January 2025 to May 2026 and a user survey from May 2026. By its own classification, the most common projects are:
- Websites: 26.4%
- Business operations tools: 21.8%
- Consumer apps: 11.8%
- Dashboards and analytics: 9.1%
- E-commerce: 7%
Together, websites and business tools account for nearly half of classified projects. Lovable also reports that four in five users identify with non-technical roles and that nearly two in three come from outside the technology industry, from retail and education to media, finance and healthcare.
That matches what we see. The strongest early use case is internal software: a CRM, an inventory screen, a client portal, built by the person who knows the workflow best.
Does 1 million projects a week mean 1 million startups?
No. In Lovable's counting, a project can be any of these:
- a test prototype or a single experiment
- one version of a landing page
- an internal utility or a personal tool
- an educational or side project
- an MVP that never launches
The survey data shows intent, not outcomes. 80% of builders work solo, and 54.6% say they are building a business. Asked about money, 60.5% say they are not monetizing yet but plan to, 15.3% earn through consulting or client work, 10.7% earn directly from the product, 9.1% use a mix, and 4.5% have no plans to monetize.
As The Next Web noted, these figures are self-reported and drawn from Lovable's own platform, with no independent audit. Read them as a picture of ambition. Roughly one in ten respondents earns directly from what they built.
The survey also shows a gender gap: 82% of respondents are men and 14% are women. Our reading is that early AI adoption, indie-hacker culture and a higher tolerance for the public risk of launching a product all skew male. Lovable itself acknowledges the gap and runs a SheBuilds program to address it.
How many startups actually get funded?
The venture funnel is far narrower than the building funnel. KPMG's Venture Pulse put global venture investment in Q1 2025 at $126.3 billion, spread across only 7,551 deals worldwide. More money concentrated in fewer companies, much of it in a handful of AI leaders.
Vibe coding lowers the cost of the first version. It does nothing to the filter after that. When building is cheap, the scarce resources are user attention, trust and distribution, and investors price exactly those. My expectation is that AI app builders will raise the number of products entering the market much faster than the number of companies that survive it. If you are on that path, our guide for fintech startups covers what investors check beyond the demo.
What are the security risks of vibe coding with Lovable?
This is the part I would not skip. The best-documented case is CVE-2025-48757, published in May 2025: insufficient database Row-Level Security in Lovable-generated sites let unauthenticated attackers read or write arbitrary tables. The CVE carries a 9.3 critical score from MITRE, and Lovable disputes it on the grounds that each customer is responsible for protecting their app's data.
Researcher Matt Palmer, who reported it, had scanned 1,645 Lovable projects and found 170 with inadequate RLS, exposing 303 endpoints. In September 2025, Wiz Research listed four recurring problems in vibe-coded apps: authentication logic running in the browser, API keys hardcoded in front-end code, overly permissive database access, and internal tools published without a login.
The issue goes beyond one platform. Veracode's 2025 GenAI Code Security Report found that 45% of code samples generated by more than 100 language models failed security tests and introduced OWASP Top 10 vulnerabilities.
Lovable has responded. Its documentation describes a Quick scan that runs on every publish and a Deep scan that reviews app logic, permissions and data, plus optional Wiz and Aikido connectors. The same documentation says the user remains responsible for the app's security and that the scans do not replace a thorough security review. For anything handling payments or personal data, take that sentence literally.
Is AI-generated software a security risk beyond vibe coding?
Yes, and 2026 made that concrete. In July 2026, OpenAI disclosed that two of its models, including GPT-5.6 Sol, escaped a test sandbox during a cybersecurity evaluation and broke into Hugging Face's production systems, as Fortune reported. On 27 July 2026, more than 30 technology companies, including NVIDIA, Microsoft, IBM and CrowdStrike, launched the Open Secure AI Alliance to build open-source AI defense tools.
If large labs struggle to contain AI systems, a solo founder shipping a Supabase-backed app over a weekend should assume security is the bottleneck, not the build.
What vibe coding does not solve
| Where AI app builders help | Where they do not |
|---|---|
| Prototypes and first versions | Choosing a market worth entering |
| Solo founders shipping without a team | Research into real customer pain |
| Internal tools and micro-SaaS | Distribution channels |
| Speed of customer discovery | User trust, security and compliance |
This is where we usually come in. At 4IRE we take vibe-coded products to production: security and architecture review, AI-driven development for the parts that need engineers, and integration with existing systems through our software development services. For teams still testing an idea, validating the project before scaling the code is cheaper than rebuilding it.
So is Lovable worth using in 2026?
For prototypes, internal tools and testing demand, yes. It is fast, and the product has matured since 2025. For a product that stores customer data or moves money, treat the generated app as a draft: review access rules, move secrets out of the front end, and get a human security review before launch. Teams in finance should also read how AI is used in finance under regulatory scrutiny.
AI speeds up building. The market still rewards depth of understanding of the customer's problem, quality of execution, and trust. Speed comes second.
FAQ on Lovable and vibe coding
Lovable is an AI app builder that creates working web applications from natural-language prompts, a practice often called vibe coding. Its June 2026 report counts more than 50 million projects built and about 1 million new projects a week.
Lovable raised a $330 million Series B at a $6.6 billion valuation in December 2025 and a $400 million Series C at a $13.3 billion valuation announced on 12 August 2026, according to TechCrunch. It reported $500 million in annualized revenue run rate as of June 2026.
They can be, but not by default for every use case. CVE-2025-48757 showed that generated apps could ship with inadequate database Row-Level Security. Lovable now runs automated scans on publish, and its own documentation says users remain responsible for security and should get a professional review for sensitive apps.
It is good for testing demand quickly and cheaply. The risks appear when an MVP becomes the production product without a review of authentication, data access rules and secrets, or without a plan for distribution and retention.