For Lovable
Your Lovable editor opening is not a launch.
Your project link at lovable.dev/projects can open just fine while you are actually looking at a locked, signed-in shell. That's a false pass. PeerRun will not call it ready.
Last verified 18 August 2026. Facts below are cited to Lovable docs and our own research notes.
After Lovable says it is done
A preview and an auto-fix button are not someone else checking your work.
After Lovable generates your app, what you get is a live preview and, if something errors out, a "Try to fix" button. That's the same AI patching its own mistake. We have not found a Lovable product that tries your app the way a real customer would, separately from the AI that built it.
Lovable does sell a different kind of check: a security scan of your codebase, plus an optional deeper AI-run test against the live app. That's a real offer, and it's still the builder checking itself. It does not tell you whether checkout, invites, or your signed-in home page actually work.
The technical detailLovable's Basic and Deep security scans review the codebase (RLS, schema, edge-function auth). An optional Aikido AI pentest runs against the live app.
Cited: Lovable security docs. Research notes: PROMPT_TO_APP_PIPELINES Part 2; TARGET_ACCESS §3B.2.
Your published site versus your editor
Your published site is public. Your editor link is the trap.
Once you publish, your app gets a real address, <name>.lovable.app, and by default anyone with that link can visit it, on every plan. Restricting access to just your team requires a paid plan; on the free and starter plans, anyone who has the link can see the site.
The backend behind it is a real server, not a simulation. That's why your published app is different from something like a Bolt in-tab preview: there's an actual computer somewhere serving it.
The trap is your editor link. lovable.dev/projects/<uuid> opens instantly, but it's an empty shell waiting for you to sign in. Whether that address can be password-protected isn't documented anywhere we could find, so we treat that as unknown rather than guessing.
How to bring a Lovable app
Give PeerRun your code, not your editor link.
Lovable can keep your code in sync with a GitHub or GitLab repository you own. Downloading your code without connecting GitHub is a paid-plan feature. Whether the sync itself requires a paid plan is not something we could confirm, so we do not claim it is free.
-
01
Connect your project to a repo you own
In Lovable, connect GitHub or GitLab and let it write your code there. That repo is the honest hand-off. PeerRun does not have a one-click Lovable importer.
-
02
Sign in to PeerRun and bring that repo or folder
Connect the same GitHub or GitLab remote, or add the folder if you already have a copy on your computer. Pasting your .lovable.app address can prove the public site is reachable. It cannot prove the signed-in parts actually work.
-
03
Tell us what's missing, on purpose
Your repo defines your database's structure, but it never contains the actual data. Your sign-in, storage, and background functions live inside Lovable Cloud unless you also move them. If we start your front end and the backend is missing, the honest status is BLOCKED or UNKNOWN with that reason. It is not "your app is broken."
Cited: GitHub integration, git sync overview, ownership. TARGET_ACCESS §5.7.
Honesty
What PeerRun will not be able to tell you
- Signed-in product
- Anything behind your Lovable sign-in, or your own login, stays Unknown until you grant access. We can see the login page exists. We cannot see past it unless you let us in.
- A bot wall
- If Cloudflare or another robot-check sits in front of your published app, the honest state is Blocked. That is not broken. We have no way around it and are not going to build one.
- Data that never left Lovable Cloud
- A database structure with no real rows in it, and a front end without its backend, are incomplete. We will name the gap. We will not invent a pass around it.
- What we do not claim
- We do not claim a one-click Lovable importer exists. We do not claim Lovable "tests nothing." They sell a security scan and an optional deeper AI test. That's a different job. We do not treat a page that opens as working software.
Questions people actually ask
Lovable, specifically
Is my Lovable app ready to launch if the preview looks right?
A preview that loads is necessary, but it's not enough on its own. Lovable's own process is preview plus an auto-fix button on build errors. Nobody independent has tried inviting a teammate, paying, or using your signed-in home page. "Ready to launch" only means something once those things are actually tried.
Can I just paste my .lovable.app link?
You can show us your public published link. If it's public, we can load the logged-out part of your site. That's a starting point, not the check. Bring us your synced code if you want the whole app tried from the source.
Will PeerRun see my users' data?
No. Syncing your code does not include your database's actual data. If you never give us backend access, we cannot see that information. That also means we cannot check anything that depends on it.
Sources
What this page is allowed to say
- Lovable GitHub integration and git sync overview
- Hosting, publish, cloud, security
- In-repo: docs/research/PEERRUN_TARGET_ACCESS_STRATEGY.md §3.1, §5.7; docs/research/PROMPT_TO_APP_PIPELINES.md Part 2
Your Lovable app can look finished. We will not pretend it is.
Sign in and bring your GitHub or GitLab sync, or the folder you already have.
We will not invent a pass. Anything behind your sign-in stays Unknown until you grant access. A robot-check is Blocked, not broken. The first look is on us.