# Lovable consultant: taking an AI-built app to production. > Lovable gets a working app in front of people quickly. SBD works with teams who now have customers, payments or staff depending on that app, and need its security, data model and failure handling reviewed and fixed. The review is $500 with a written report within a week, for teams of 5 to 1,000 people. - Canonical: https://smallbaydigital.com/integrations/tools/lovable/ - Publisher: SmallBay Digital ## What SBD does with a Lovable app Most of the work sits in what a prompt does not settle: who may read which rows, what happens when a payment or an email fails, how the data model copes as records grow, and who looks after the app once it is live. We read the code and the database, test the app logged out and as each kind of user, and write down what we find with a price for each fix. SBD has no published case study on Lovable. The closest published work is on the stack these apps often end up needing: [an operations tool on Next.js and Supabase with roles enforced on the server](https://smallbaydigital.com/case-studies/consulting-internal-tool/), and [a live outbound platform on Supabase with tenant isolation on every row](https://smallbaydigital.com/case-studies/intellreach-ai-outbound-platform/). Neither is a Lovable project, so read them as evidence of the standard we would hold your app to. - Security review of access rules, secrets, sign-in and exposed endpoints. - Fixes to row-level security policies and the server code that relies on them. - Data model changes before migrations get harder to run. - Error handling, logging and alerts so failures reach a named person. - A keep-or-rebuild recommendation when the generated code will not carry the next stage. ## What Lovable's scanner covers, and what it leaves to you Lovable's security documentation, read in November 2026, describes two scans. A quick scan runs when you publish and covers a database review, known npm vulnerabilities and MCP servers exposed without authentication. A deep scan also reviews application code for access control, unauthenticated endpoints, unsafe input, leaked secrets, payments and exposed personal data, and it has to be started by you. Run both, because they are useful and cheap. The same documentation says these tools do not replace a thorough security review, and it recommends a professional review for apps handling sensitive data or critical functions. That review is what our [MVP audit](https://smallbaydigital.com/mvp-audit/) provides. We wrote up the most common failure in [your Lovable app is probably public](https://smallbaydigital.com/blog/your-lovable-app-is-probably-public/), with a check you can run yourself first. ## Lovable plans and the limits that affect a production app Lovable's plan documentation, read in November 2026, lists Pro from $25 a month and Business from $50 a month, each for 100 credits, with higher credit tiers above that and Enterprise priced through sales. Workspaces allow unlimited members on all plans. Monthly plan credits expire two months after they are issued. Three details matter for a business app. Single sign-on starts on Business. Audit logs and SCIM are listed on Enterprise only, so an auditor's request for a Lovable activity log may decide the plan. And on Pro, publishing to invited people only is capped at 10 people per project, which an internal tool can pass quickly. ## Moving the code out of Lovable Lovable's GitHub documentation, read in November 2026, describes two-way sync on one branch at a time, private repositories by default, and a download of the codebase on paid plans. It also says the sync lets you deploy outside Lovable. So developers can take the app further, in your repository, and we set that up early in a hardening job so every fix has a history. Once your developers work in the repository, agree who prompts and who commits. Two people changing the same branch from two directions is an easy way to lose a fix. ## When Lovable is the right choice, and when it is not Lovable suits a new product or tool where the screens are still changing and you may want developers to own the code later. A prototype with no real data does not need our review, and we will say so. Look elsewhere in these cases, or plan a rebuild: - Staff need to edit screens by hand without touching prompts or code. [Softr](https://smallbaydigital.com/integrations/tools/softr/) is usually easier for them. - The tool sits on databases and APIs you already run, with engineers looking after it. [Retool](https://smallbaydigital.com/integrations/tools/retool/) fits that better. - The app handles regulated data and you cannot justify the plan that carries audit logs. - The generated data model is wrong at its core, so fixes would cost more than a rebuild. The audit report says which applies. ## How a Lovable engagement with SBD works Start with the [MVP audit](https://smallbaydigital.com/mvp-audit/) at $500, with a written report within a week. The report lists each fix with a fixed price. [Hardening](https://smallbaydigital.com/services/harden/) starts at $1,500 and takes about two weeks, and a rebuild starts at $8,000. New internal tools start at $3,000 and multi-module systems at $5,000, and we prefer your hardest screen first so problems surface early. ## Related - [MVP audit](https://smallbaydigital.com/mvp-audit/) - [Harden service](https://smallbaydigital.com/services/harden/) - [For teams on Lovable](https://smallbaydigital.com/for/teams-on-lovable/) - [Your Lovable app is probably public](https://smallbaydigital.com/blog/your-lovable-app-is-probably-public/) - [Supabase integrations](https://smallbaydigital.com/integrations/tools/supabase/) - [Zite consultant](https://smallbaydigital.com/integrations/tools/zite/) ## Sources - Lovable Docs: Subscription plans (prices, SSO, audit logs, SCIM, invited publishing), checked 2 November 2026 - Lovable: Pricing (unlimited members, credit expiry), checked 2 November 2026 - Lovable Docs: Security (quick scan, deep scan, stated limits), checked 2 November 2026 - Lovable Docs: GitHub integration (two-way sync, code download, deploying elsewhere), checked 2 November 2026