Lovable adds Deel and Retool connectors, requires security review before publishing

Lovable published a changelog update on November 12, 2026 that adds Deel and Retool connectors and introduces a security review before publishing projects that use its built-in backend, according to the Lovable changelog.

New connectors and security controls

• A new Deel connector lets apps read and update a company's contracts, people records, timesheets, time off and payment information.
• A new Retool connector lets apps manage the members, groups and permissions of a Retool organization, and embed existing Retool apps.
• Projects using Lovable's built-in backend with unresolved critical security findings are now reviewed before publishing, and users can view the findings, publish anyway, or request one free automated fix.
• Security findings can be fixed directly from the project chat, with a banner showing unresolved critical findings and warnings plus a Fix all action.
• New Run Usage Alerts notify workspace admins and owners by email and in-app when daily run usage on paid plans spikes compared with the trailing 7-day average.
• Enterprise audit logs now record the specific commit published in each publish event, for traceability back to the source codebase.

What it means for people building with AI

Lovable is pairing the new business-system integrations with a publish-time security gate aimed at stopping vibe-coded apps from shipping with known critical vulnerabilities. For builders who connect Deel or Retool to handle real payment, timesheet or permissions data, the review adds a checkpoint before that data flow goes live, while still leaving the choice to publish without a fix or request an automated one.

How to add the connectors

Both the Deel and Retool connectors are accessible through the Connectors menu or by asking Lovable's chat assistant to add the integration, the same chat interface now used to fix flagged security findings.

Sources

• Changelog (Lovable, November 12, 2026, official)

Written with AI assistance, strictly from the sources listed above. Before it went live, automated checks verified its dates, sources and every language edition.