Lovable blocks publishing of apps with unresolved critical security findings

Lovable announced on November 12, 2026, that it added a publish gate requiring users to review any unresolved critical security findings before shipping apps built on its platform, according to the Lovable changelog. The update also includes new in-chat security fixes, usage spike alerts, and audit log improvements for enterprise customers.

What changed

• Projects built on Lovable's built-in backend now block publishing until users review any unresolved critical security findings.
• Project chat surfaces a running count of open critical issues and warnings, letting users resolve them conversationally without leaving the chat.
• Admins on paid workspace plans now receive alerts when daily agent run usage spikes significantly compared to the previous week.
• Lovable's Enterprise audit log now records the exact commit tied to each publish action.

What it means for builders

The publish gate adds a default safety guardrail for non-engineers who ship apps with Lovable's AI agent, directly addressing the risk of vibe-coded apps going live with unresolved critical vulnerabilities. By surfacing issue counts inside the project chat, Lovable lets users resolve security problems without leaving their conversational workflow, while the new usage spike alerts and commit-linked audit log give paid and enterprise teams more visibility into how their apps are built and published.

Sources

• Lovable changelog (Lovable, November 12, 2026, official)

Written with AI assistance, strictly from the sources listed above. Before it went live, automated checks verified its dates, sources and every language edition.