Lovable

Security assessment

Plutonium assessed this plugin for permissions, capabilities, and security-relevant behavior.

• App creates a hosted full-stack project: Can deploy code, applications, containers, workflows, or infrastructure to a persistent environment.
• ChatGPT conversation context is sent to Lovable: Can send prompts, files, queries, or connected-service data to an external service.
• Connector creates a persistent Lovable project: Can create or change persistent records, files, projects, permissions, settings, or credentials.
• Connected hosted app maintains account authorization: Uses credentials, OAuth grants, API keys, or tokens that may remain valid after the current session.
• Prompt starts an automated application build: Can execute code, commands, scripts, unrestricted queries, or dynamic gateway actions.
• Starting the build consumes Lovable credits: Can initiate purchases, paid jobs, payments, refunds, infrastructure spend, or other financial activity.