Code and agents · Sweden (Stockholm)
Lovable
An app builder born from an open-source tool reached a hundred-million-dollar annual revenue claim in eight months without paid ads; the bill for speed arrived as security debt, and retention and margin evidence is still missing.
Verdict: Gaps remain
Updated: 2026-10-06
01
Profile
- What it does
- A platform that builds full-stack web apps from natural language. The previous product was the open-source GPT Engineer; around 52 thousand GitHub stars meant a ready audience on launch day [5].
- Founded
- 2023, Stockholm. GPT Engineer App was renamed Lovable in December 2024; the official blog counts the launch from November 2024 [7].
- Founders
- Anton Osika (CEO) and Fabian Hedin (CTO) [7].
- Pricing model
- Credit-based. The free plan grants 5 credits a day (up to 30 a month) plus 20 cloud credits; Pro, Business and volume-based Enterprise [4]. With the Agent launch, fixed per-message pricing became variable credits: a simple style change costs 0.50 credits, authentication 1.20, a landing page with images 1.70 [1].
02
Growth timeline
2024-11
Launch; $4M revenue in the first four weeks (founder claim)
"$4 million in first four weeks"
[5]2025-01-28
$10M ARR in two months, 15 people (official blog)
[3]2025-05-29
CVE-2025-48757: 170 of 1,645 apps leaking data
reported in March, the company initially denied it
[6]2025-07-23
$100M ARR claim in eight months; 10M+ projects
"the fastest-growing startup, not just in Europe, but in the world"
[1]2025-12-18
$330M Series B at a $6.6B valuation
[3]2026-08-12
$400M Series C at $13.3B; 60M+ projects
"900M+ monthly visits to Lovable-built apps"
[2]
03
Growth loop
- 1Natural-language prompt
- 2Working app in 30 seconds
- 3Shared output, app traffic
- 4New user, credit consumption
- 5Daily release, new model
- Leak: security debt: exposed apps, lost trust
The loop turns on the output itself: every app built is both an ad and a distribution point. The red arrow shows the bill for fast-built apps coming back as a security hole and lost trust.
The drawing shows the shape of the loop; each node is explained in the list below. The red arrow marks value leaking out of the loop.
04
Mechanism
- Acquisition channels
- The open-source community was built before the product; GPT Engineer's 52K GitHub stars meant an audience on launch day [5]. Then founder brand and short demo videos (secondary compilation) [8]. According to a secondary compilation there was no paid acquisition up to $300M ARR and the paid share in year one was under ten percent (secondary data) [8]. The primary source was not opened; these figures are relayed, not stated.
- Loop
- A user types a sentence and gets a working app in thirty seconds; shares the output, the app's own traffic flows back to the platform, new users consume credits, revenue goes into daily releases and new model integrations. A second loop appears in the Series C post: over 900 million monthly visits to apps built with Lovable [2]. The product's output becomes the product's distribution.
- Activation
- An Airbnb clone in thirty seconds in a live demo; according to the founder the breakthrough was the model fixing its own mistakes, "AI unsticking itself" [5]. With the Agent launch the company measured errors down 91 percent [1]; that is an internal count, not a customer outcome.
- Retention evidence
- No churn or NRR on the official blog. A secondary compilation cites 85 percent day-30 paid retention and NDR above 100 percent (secondary data) [8]; no primary source was found. The Series C post cites a user survey in which nearly eight in ten are building a business or side project they hope to monetize and a third of those already generate revenue [2]; that is a survey or internal measure, not a cohort. No retention evidence.
- Role of pricing
- The credit model has three layers: subscription, top-ups, and outcome-based pricing in the future (secondary data) [8]. With the Agent launch, credits vary by task complexity [1]; the cost of the same job became unpredictable for the user. No gross-margin disclosure.
- Distribution moves
- Security investment for enterprise trust: AIUC-1 certification (22 July 2026) and a dedicated security page for every business (5 August 2026) [3]; Google Workspace, Microsoft 365, Salesforce, Stripe and ElevenLabs integrations plus security scanning [2]. This sequence reads as a direct answer to the 2025 security incident (opinion).
05
Real reading
The five questions of the Growth Claim Check, applied to this company's public claims.
- 01
What was measured, and by whom?
yes
ARR is on the official blog and dated; but it mixes credit consumption with subscriptions, and the company sets the definition.
- 02
Perception or outcome?
yes
Revenue is an outcome; claims like "errors −91%" are the company's internal measures.
- 03
Is there a stability or quality metric?
unclear
No official churn; 170 exposed apps are a quality signal, the later certifications a correction signal.
- 04
Is there a counterfactual or cohort?
no
No control group or cohort disclosure.
- 05
Nominal or real?
unclear
Free-day campaigns and credit consumption blur the revenue definition; the base for "quadrupled ARR" is unclear.
Verdict
Gaps remain
One of the best-documented official ARR claims in the coding category; but no evidence on retention, churn or margin. The speed is real, the quality is unknown.
Test your own claim with the same five questions: Growth Claim Check →
06
Shadow side
- Security: a Replit engineer reported missing row-level access control in March 2025 and the company initially denied it; according to CVE-2025-48757 published in May, 170 of 1,645 apps were leaking names, emails, financial data and API keys. The company's response: "We're not yet where we want to be in terms of security" [6].
- Pricing: the switch to variable credits with Agent made the cost of the same job uncertain [1]; user reaction could not be sourced tonight.
- Margin: no model-cost or gross-margin disclosure.
07
What it teaches a founder in Türkiye
This section is opinion; a reading, not a source.
- 01
(opinion) Build the community before the product. The open-source tool prepared the launch-day audience. Turkey's developer community is small but GitHub is global; this may be the cheapest route to the first thousand users.
- 02
(opinion) When the output can be shared, the marketing budget sits inside the product. Account for the free tier as a channel, not a cost; but see that channel's price in the token bill.
- 03
(opinion) Speed creates security debt. A team that ships daily without a security team turns into a product-quality risk; when you move to enterprise sales the bill is paid in certifications and a trust center.
- 04
(opinion) The credit model speeds growth and weakens the word "ARR". For a founder pricing in lira, the gap between dollar-based token cost and credit price is the real risk. Test question: does what a user paid this month mean they will pay next month?
- 05
(opinion) You can go global from Europe, and without a sales team. But the plan to reach 450 people shows where the "zero sales" story ends.
A question for you: remove this company's logo and drop the loop onto your own product. Which node stays empty?
08
Sources
Numbers are the references in the text. An 'opened' source was read by the researcher; 'secondary' ones are verified against their primary source before publication.
- [1]$100M ARR & Lovable Agent
Lovable (official blog) · 2025-07-23 · opened
“This makes us the fastest-growing startup, not just in Europe, but in the world.”
- [2]We just raised $400M in Series C funding
Lovable (official blog) · 2026-08-12 · opened
“Since Lovable's launch in November 2024, people have created more than 60 million projects, and Lovable-built apps see over 900 million visits every month.”
- [3]Lovable blog index (Series A/B, the $10M post, security, integrations)
Lovable (official blog) · accessed 2026-10-05 · opened
“Zero to $10M ARR in 2 months”
- [4]Lovable pricing page
Lovable · accessed 2026-10-05 · opened
“daily grant of 5 build credits (up to 30 a month)”
- [5]Building Lovable: $10M ARR in 60 days with 15 people
Lenny's Newsletter (Anton Osika interview) · 2025-03-09 · opened
“By first releasing the CLI tool GPT-Engineer to the open source community (earning 52K stars on GitHub)”
Note: On the Lenny's Newsletter page; also: "Lovable hit $4 million ARR in the first four weeks and $10 million ARR in two months"
- [6]The hottest new vibe coding startup Lovable is a sitting duck for hackers
Semafor (Reed Albergotti) · 2025-05-29 · opened
“We're not yet where we want to be in terms of security and we're committed to keep improving the security posture for all Lovable users.”
- [7]Lovable (company)
Wikipedia (secondary, sourced) · accessed 2026-10-05 · opened
“GPT Engineer App ... renamed Lovable in December 2024”
- [8]How Lovable hit $400M ARR in 14 months
The AI Corner (secondary compilation) · 2026-05-29 · opened
Note: compilation; retention, paid share and team figures come from here, primary source not opened
- [9]Anton Osika, Series C post
X · 2026-08-12 · secondary
Relayed wording: quadrupled ARR in the last 12 months
- [10]Lovable raises $330M Series B at $6.6B valuation
Lovable (official blog) · 2025-12-18 · opened
“Lovable has raised $330 million in Series B funding at a $6.6 billion valuation”
09
Open questions
- Primary source for the day-30 paid retention of 85%, NDR above 100% and $2M spend from 0 to $30M ARR claims (which founder podcast or post).
- The November 2025 report of $200M ARR and 8M users (TechCrunch) should be opened.
- Is there any gross-margin or model-cost disclosure.
- User reaction to the switch to variable credits.