Lovable hit $600 million in revenue while its apps kept leaking passports

LovablePVT~$1.8B — Lovable, private, latest valuation ~$1.8B, the Stockholm platform that turns plain-language prompts into working web apps, hit $600 million of annual revenue by September 2026↗ ¹, the first time an outlet has put the figure in print. Its valuation says $13.3 billion, set by a $400 million round co-led by Menlo Ventures and the EU-backed Scaleup Europe Fund in August 2026 ¹. That prices the company at roughly 22 times revenue ¹, and the mark rose faster than the business behind it.

The revenue step is flattening

Lovable's own milestone series, compiled and published on November 4, shows the pattern ¹. $100 million in annual recurring revenue within eight months of its November 2024 launch, $200 million by November 2025, $400 million by March 2026, over $600 million by September ¹. That is $200 million added in five months, then the same $200 million again in the next six ¹¹.

The valuation moved from $1.8 billion in July 2025 to $6.6 billion in December 2025 to $13.3 billion in August 2026 ¹. Over the last seven months of that run the valuation doubled while revenue grew 50 percent ¹. Anton Osika and Fabian Hedin, the founders, entered the Forbes billionaires list along the way ¹.

Nobody has priced what it ships

A German security firm's study of the open web archive Common Crawl↗ covered 159,041 Lovable projects published between December 2025 and September 2026 ³. Of these, 34,545 used Supabase, the open-source database Lovable wires in by default ³. On 24,664 sites, database records loaded with no login at all ³. Read-only calls with the same API key surfaced email addresses on 7,403 sites, across 10,560 tables ³. The worst finds: one provider exposed 280,000 customer emails, another more than 1,000 identity records with passport numbers, a lifestyle forum over 200,000 chat messages ³.

Lovable says security is the user's job

The researchers note the integrations follow identical patterns, so an attack that works on one app works across the estate ³. They excluded Lovable's own database functions, added only in late 2025 ³. The newest, likely most-used path is unmeasured ³. Lovable says users are responsible for setting up security ⁴. CrowdStrike▲+3.38% — CrowdStrike, up 3.38 percent today, the listed cybersecurity company, now sells visibility into Lovable workspaces through its Falcon Shield product, announced November 3↗ ⁵, an offering that exists because Lovable-built apps sit outside the security teams' existing view of what holds company data.

The backer is raising while the exit is missing

Creandum, an early Lovable backer, closed a $750 million fund on November 2↗, its largest, and says Lovable, the fintech Trade Republic and the cloud company Modal have each passed $10 billion ⁶. Europe, where startup investors raised $33 billion this year against $134 billion in the US ⁶, offers fewer paths to sell or list a company at those levels ⁶. London, opened in October with 70 staff heading to 100↗ ², deepens the engineering bench but answers no exit question.

That leaves Lovable priced at 22 times revenue, carrying a security exposure nobody has measured, with no obvious buyer at $10 billion ¹³⁶. What decides the price from here is the next revenue print, and whether Lovable publishes what the Common Crawl study could not measure ¹³.