10.3%
of 1,645 scanned Lovable apps exposed their database
CVE-2025-48757: 170 apps with missing row-level security, 303 vulnerable endpoints. Whoever migrates your app should audit every policy.
Matt Palmer: CVE-2025-48757 ↗Lovable migration services by X & Company
Migrate off Lovable.Keep everything you loved.
Your Lovable code already syncs to GitHub. Your database, users, files, secrets and AI calls live on Lovable Cloud. X & Company moves all of it to your own Supabase or your own servers, without breaking a single login.
- Tables
- RLS policies
- Auth users
- Storage buckets
- Edge functions
- Secrets
- Cron jobs
- Custom domain
- Lovable AI calls
- Email sending
Your Lovable app, layer by layerIn your GitHubOfficial exportMoved by hand
- FrontendAlready in GitHubReact + Vite + TailwindYour repo
- Database & RLS5 GB export, once a dayLovable CloudYour Supabase or Postgres
- Auth usersIncluded in the exportLovable CloudYour auth
- Storage filesNot in the exportLovable CloudS3 · R2 · Supabase
- Secrets & AIRe-enter & re-keyLovable AI · SecretsYour own keys
Lovable by the numbers
Love the builder. Know the fine print.
From Lovable’s pricing page and docs, plus the most-cited security disclosure in vibe coding. The good news is at the end: your code is already yours.
5 GB
cap on a Lovable Cloud database export
One export every 24 hours, from Advanced settings. Bigger databases go through Lovable support.
Lovable Docs: Advanced settings (Cloud export) ↗0
storage files or secrets in that export
It carries schema, data, policies and auth users. Files, edge function code and secret values move separately.
Lovable Docs: Advanced settings (Cloud export) ↗$25/mo
Pro plan, 100 monthly credits
Plus 5 daily credits. Monthly credits expire after two months, so unused capacity doesn’t bank for long.
Lovable pricing ↗20
Cloud credits a month, then usage pricing
Every plan gets a monthly Cloud grant. Bigger apps can start paying for hosting and database on top of the plan.
Lovable pricing ↗All plans
get two-way GitHub sync, including Free
Your React, Vite and Tailwind frontend is already in a repo you control. That’s the easy part of a Lovable migration.
Lovable Docs: GitHub integration ↗Lovable Cloud is built on Supabase’s open-source foundation (Lovable Docs). Checked September 2026; confirm current plans on lovable.dev.
Why teams leave Lovable
From first prompt to product. Then it needs a real home.
Lovable is one of the best ways to go from idea to working app. Once real users and revenue arrive, most teams want to own the backend, the bill and the security story.
Your backend is on Lovable Cloud
Lovable Cloud runs your database, auth, storage and edge functions on a Supabase foundation that Lovable manages. The code syncs to GitHub. The backend doesn’t.
Credits for building, credits for running
Build credits pay for every prompt. Cloud usage past the monthly grant is billed on top. Monthly credits expire after two months.
Security you have to prove
CVE-2025-48757 showed how easily generated apps ship with missing row-level security. Customers and auditors will ask how yours is protected.
AI through someone else’s gateway
Lovable AI routes model calls through Lovable’s gateway and bills them as usage. Your own OpenAI, Anthropic or Gemini account gives you limits, pricing and terms you control.
Scaling on platform terms
Instance size, storage and limits are changed through Lovable’s settings and billed through Lovable. Bigger apps pay more on top of the plan.
Prompting isn’t a deploy process
Production apps need staging, code review, tests and rollbacks. Those are much easier once the whole stack lives in your repo and your cloud.
What a Lovable migration involves
The code is already yours. The Cloud needs moving.
Since July 2026, Lovable Cloud has an official export. It’s a real help, and it still leaves the storage files, secrets, AI calls and jobs for someone to move by hand, in the right order, without logging anyone out.
Comes out cleanly
- Your full frontend (React, Vite, Tailwind), via two-way GitHub sync on every plan
- Supabase migrations, edge function code and RLS policies that live in the repo
- A Cloud database backup: schema, data, policies and auth users with password hashes (up to 5 GB, once per 24 hours)
Moved by hand
- Files in storage buckets. Download and re-upload them yourself
- Secret values. Every key has to be re-entered, ideally rotated
- Lovable AI calls, which run through Lovable’s gateway and key
- Scheduled jobs, which need to be recreated on the target
- Your published *.lovable.app URL. Custom domains need re-pointing
What changes in a Lovable repo
# .env
- VITE_SUPABASE_URL=https://<lovable-cloud-project>.supabase.co
+ VITE_SUPABASE_URL=https://<your-project>.supabase.co # or your own API
# supabase/functions/chat/index.ts
- fetch("https://ai.gateway.lovable.dev/v1/chat/completions", { headers: { Authorization: `Bearer ${LOVABLE_API_KEY}` } })
+ fetch("https://api.openai.com/v1/chat/completions", { headers: { Authorization: `Bearer ${OPENAI_API_KEY}` } })
# src/integrations/supabase/client.ts stays the same — it just points somewhere you own.Two ways off Lovable
Pick your destination. We’ll handle the move.
Lovable Cloud is built on Supabase’s open-source foundation, so there are two clean exits. The audit tells you which one fits your app, budget and compliance needs.
Your own Supabase
Move Lovable Cloud into a Supabase project you own. The code barely changes, and you get the Supabase dashboard, backups and billing directly.
- Fastest route off Lovable Cloud
- Users keep their passwords
- Keep building in Lovable if you want
Fully self-hosted
Run PostgreSQL, auth, storage and your API on AWS, a VPS or on-prem. The most control, the clearest compliance story and the most predictable bill.
- Your region, your network, your rules
- No platform in the path of a request
- Ideal for SOC 2, HIPAA or data residency
The X & Company process
Four steps from Lovable to a stack you own.
The same method on every project, whether it’s a small internal tool or a SaaS product with paying customers. You always know what’s happening, what’s next and what it costs.
Audit & plan
We clone your repo and inventory every table, RLS policy, auth provider, storage bucket, edge function, secret, cron job and Lovable AI call. Every policy gets a security review.
- Inventory & RLS audit
- Path A or B decision
- Fixed-scope quote & timeline
Stand up the target
Your own Supabase project, or PostgreSQL, auth and storage on your servers. Edge functions are redeployed, cron jobs recreated, and Lovable AI calls moved to your own model provider.
- Database & policies
- Edge functions & jobs
- Your own AI keys
Migrate data & users
We restore the Cloud export with auth users and password hashes intact, copy every storage file, rewrite file URLs and re-link OAuth sign-ins, so nobody has to reset a password.
- Row-count reconciliation
- Files moved to your storage
- Logins that just work
Cut over & hand off
We deploy the frontend to your host, run a final sync, move your domain off *.lovable.app with a rollback plan ready, and hand over the repo, runbooks and every key.
- Production deploy
- Monitoring & backups
- Docs & knowledge transfer
Lovable Cloud vs. your stack
What changes when you get off Lovable
A fair comparison. Lovable is a strong place to start. Your own stack is where you go when control, cost predictability and security reviews start to matter more than build speed.
| Topic | Staying on Lovable | After migration |
|---|---|---|
| Code | Two-way GitHub sync on every plan | Same repo, plus CI, reviews and tests |
| Database | Lovable Cloud; 5 GB export once a day | Your Supabase or Postgres, full access & backups |
| Auth & users | Managed inside Lovable Cloud | Your auth, same users, same passwords |
| Storage | Cloud buckets, not in the export | S3, R2 or Supabase Storage you own |
| AI features | Lovable AI gateway, billed as usage | Your OpenAI, Anthropic or Gemini accounts |
| Pricing model | Build credits + Cloud usage past the grant | Infrastructure cost you can see and tune |
| Security | RLS generated by prompts | Policies reviewed, tested and documented |
| Releases | Publish from the editor | Staging, CI/CD and one-command rollbacks |
What you get
A finished migration, not a zip file.
X & Company delivers a working production system on infrastructure you own, and a team that understands how it works.
Talk to X & CompanyYour full source code
Your repo in your GitHub organization, building and deploying without Lovable in the loop.
A production database
Every table and RLS policy moved, reviewed and tested, with backups and every row reconciled.
Users, preserved
Accounts, password hashes and OAuth sign-ins carried over, so customers log in like nothing happened.
Hardened hosting
Your server behind Nginx with Certbot SSL, firewalling and monitoring. AWS, a VPS or on-prem.
A deploy pipeline
Push to main and ship. Staging and production environments you can reason about.
Runbooks & handoff
Docs for deploys, backups, restores and on-call, plus a walkthrough with your team.
Readiness check
Is it time to get off Lovable?
Tick every statement that’s true for your app. It takes 20 seconds.
0/8signals
Check the statements that apply to you.
Your score updates as you go. Nothing is sent anywhere; it all runs in your browser.
Get an expert opinionCost calculator
What does staying on Lovable really cost?
Move the sliders to match your situation. The numbers are illustrative and use your own inputs, and cost is rarely the only reason teams migrate. It still helps to see it.
Free Lovable migration guides
Prefer to do it yourself? Start here.
Everything we’ve learned about getting off Lovable, written up in plain language. If you decide you’d rather have it done for you, we’re one click away.
How to Migrate Off Lovable (Step-by-Step)
From GitHub sync to switching DNS. Eight steps covering code, database, users, files, secrets, AI calls and hosting.
Read guideHow to Export Your Data from Lovable Cloud
What the official Lovable Cloud export includes, what it leaves out, and how to move the rest without losing a row.
Read guideThe Lovable Migration Security Checklist
A migration is the best time to fix security. What CVE-2025-48757 taught us, and a checklist for RLS, keys, auth and storage.
Read guideDone for you
Skip the guides. We’ll migrate it.
X & Company takes your Lovable app from audit to live on your own server, for a fixed-scope quote.
Get a free assessment →Questions
Lovable migration FAQ
Can I export my code from Lovable?
Yes. Lovable offers two-way GitHub sync on every plan, including Free. Your React, Vite and Tailwind frontend, plus the Supabase migrations and edge function code in the project, live in a repository you own. What GitHub doesn’t carry is the live backend on Lovable Cloud: the data, storage files, secrets and deployment.
How do I get my data out of Lovable Cloud?
Since July 2026, Lovable Cloud has an official Export action in Advanced settings. It creates a backup with your schema, data, security policies and auth users, up to 5 GB and once every 24 hours. Storage files, edge function code and secret values aren’t in it, so those are moved separately. Larger databases go through Lovable support.
Will my users have to reset their passwords?
Usually not. The Lovable Cloud export includes auth users with their password hashes, so users can sign in with their existing passwords after the move. We also re-link OAuth sign-ins like Google and GitHub on your own provider accounts, and test every sign-in method before cutover.
Should I move to my own Supabase or fully self-host?
Moving to your own Supabase project is the fastest path: the code barely changes and you get full dashboard access and direct billing. Full self-hosting on AWS, a VPS or on-prem gives you the most control and the clearest compliance story. The audit recommends one based on your app, budget and requirements.
What about the Lovable security issue I read about?
CVE-2025-48757, disclosed in 2025, found that 170 of 1,645 scanned Lovable apps (about 10%) had database tables readable or writable without proper row-level security. Lovable improved its defaults afterwards, but policies generated by prompts still deserve a human review. We audit and test every RLS policy as part of the migration.
What happens to features that use Lovable AI?
Lovable AI calls models through Lovable’s gateway with a Lovable key. We point those edge functions at your own OpenAI, Anthropic or Google account instead, which gives you your own rate limits, pricing and data terms.
Can I keep using Lovable after migrating?
If you move to your own Supabase project, you can connect it to Lovable and keep prompting while developers work in the same GitHub repo. Many teams do that for a while, then move to tools like Cursor or Claude Code as the codebase matures.
How long does a Lovable migration take, and will there be downtime?
Scope depends on data size, storage, edge functions, integrations and which path you choose. You get a fixed timeline and quote after the audit. Downtime is minimal: the new stack is tested in parallel, then a brief write freeze covers the final sync before your domain moves over.
Is this site affiliated with Lovable?
No. This is an independent resource run by X & Company, a software studio that provides Lovable migration services. Lovable is a trademark of its owner.
Ready to migrate off Lovable?
Tell X & Company about your app. You’ll get a straight answer on scope, timeline and cost, and a plan to own your whole stack.