---
title: "Lovable hit $600 million in revenue while its apps kept leaking passports"
description: "The first print of Lovable's revenue shows the step flattening while the valuation doubled. In the same week, a scan of 159,041 of its published apps found emails and passport numbers open to anyone, and a backer closed its largest fund in a continent with few ways to sell a $10 billion company."
publisher: "The Inference"
section: "Platforms"
published: 2026-11-05T14:43:49.769Z
modified: 2026-11-05T14:43:49.769Z
canonical: https://theinference.org/article/lovable-hit-600-million-in-revenue-while-its-apps-kept-leaking-passports
language: en
keywords: "Lovable, Vibe Coding, ARR, Cybersecurity, Venture Capital"
---

# Lovable hit $600 million in revenue while its apps kept leaking passports

> The first print of Lovable's revenue shows the step flattening while the valuation doubled. In the same week, a scan of 159,041 of its published apps found emails and passport numbers open to anyone, and a backer closed its largest fund in a continent with few ways to sell a $10 billion company.

[Lovable](https://theinference.org/markets/companies/lovable), the Stockholm platform that turns plain-language prompts into working web apps, [hit $600 million of annual revenue by September 2026](https://gaya.one/en/money/companies/epoha-vibe-coding-kak-lovable-naucil-mir-sozdavat-prilozenia-siloj-mysli) [1], the first time an outlet has put the figure in print. Its valuation says $13.3 billion, set by [a $400 million round co-led by Menlo Ventures and the EU-backed Scaleup Europe Fund](https://theinference.org/article/meta-plugged-a-13-3-billion-startup-into-its-free-agent-the-week-an-early-investor-sold-at-225x) in August 2026 [1]. That prices the company at roughly 22 times revenue [1], and the mark rose faster than the business behind it.

## The revenue step is flattening

Lovable's own milestone series, compiled and published on November 4, shows the pattern [1]. $100 million in annual recurring revenue within eight months of its November 2024 launch, $200 million by November 2025, $400 million by March 2026, over $600 million by September [1]. That is $200 million added in five months, then the same $200 million again in the next six [1][1].

The valuation moved from $1.8 billion in July 2025 to $6.6 billion in December 2025 to $13.3 billion in August 2026 [1]. Over the last seven months of that run the valuation doubled while revenue grew 50 percent [1]. Anton Osika and Fabian Hedin, the founders, entered the Forbes billionaires list along the way [1].

*Chart: **The valuation doubled while revenue grew 50 percent** Column chart of Lovable's valuation at three milestones, rising from $1.8 billion in July 2025 to $6.6 billion in December 2025 to $13.3 billion in August 2026.*

*Lovable's valuation at each funding milestone, in billions of US dollars: $1.8 billion in July 2025, $6.6 billion in December 2025, $13.3 billion set by the $400 million round of August 2026. Over the last seven months of that run the valuation doubled while revenue grew 50 percent. Source 1. [1]*

*Chart: **Lovable's revenue doubled to $600M, but the last step took longer** Column chart of Lovable's annual recurring revenue at four reported milestones, showing the March to September 2026 step taking six months versus five before it.*

*Lovable's annual recurring revenue at reported milestones in US dollars, per the company's own milestone series as compiled on November 4, 2026: $100M within eight months of the November 2024 launch, $200M by Nov 2025, $400M by Mar 2026, over $600M by Sep 2026. Source 1. [1]*

## Nobody has priced what it ships

A German security firm's [study of the open web archive Common Crawl](https://www.techzine.eu/news/security/145550/thousands-of-lovable-apps-are-leaking-personal-data/) covered 159,041 Lovable projects published between December 2025 and September 2026 [3]. Of these, 34,545 used Supabase, the open-source database Lovable wires in by default [3]. On 24,664 sites, database records loaded with no login at all [3]. Read-only calls with the same API key surfaced email addresses on 7,403 sites, across 10,560 tables [3]. The worst finds: one provider exposed 280,000 customer emails, another more than 1,000 identity records with passport numbers, a lifestyle forum over 200,000 chat messages [3].

## Lovable says security is the user's job

The researchers note the integrations follow identical patterns, so an attack that works on one app works across the estate [3]. They excluded Lovable's own database functions, added only in late 2025 [3]. The newest, likely most-used path is unmeasured [3]. Lovable says users are responsible for setting up security [4]. [CrowdStrike](https://theinference.org/markets/companies/crowdstrike), the listed cybersecurity company, now sells visibility into Lovable workspaces through its Falcon Shield product, [announced November 3](https://finviz.com/news/413945/crowdstrike-and-lovable-secure-the-next-generation-of-ai-built-applications) [5], an offering that exists because Lovable-built apps sit outside the security teams' existing view of what holds company data.

## The backer is raising while the exit is missing

Creandum, an early Lovable backer, [closed a $750 million fund on November 2](https://www.briefs.co/news/creandum-raises-750-million-for-its-biggest-early-stage-fund/), its largest, and says Lovable, the fintech Trade Republic and the cloud company Modal have each passed $10 billion [6]. Europe, where startup investors raised $33 billion this year against $134 billion in the US [6], offers fewer paths to sell or list a company at those levels [6]. London, [opened in October with 70 staff heading to 100](https://europreneursmedia.com/news/lovable-opens-london-office-70-staff/) [2], deepens the engineering bench but answers no exit question.

That leaves Lovable priced at 22 times revenue, carrying a security exposure nobody has measured, with no obvious buyer at $10 billion [1][3][6]. What decides the price from here is the next revenue print, and whether Lovable publishes what the Common Crawl study could not measure [1][3].

## Takeaway

Lovable's first printed revenue figure shows the growth step slowing even as its valuation doubled to $13.3 billion, while a scan found 24,664 of its published apps exposing data with no login; the price now hinges on the next revenue print and on what Lovable publishes about its unmeasured security surface.

## Sources

1. [Gaya One, $13.3 billion in two years: how Lovable turned an idea into one of the fastest-growing businesses in history, 4 November 2026](https://gaya.one/en/money/companies/epoha-vibe-coding-kak-lovable-naucil-mir-sozdavat-prilozenia-siloj-mysli)
2. [Europreneurs Media, Lovable opens London office with 70 staff, aims for 100, 2026](https://europreneursmedia.com/news/lovable-opens-london-office-70-staff/)
3. [Techzine Global, Thousands of Lovable apps are leaking personal data, 2026](https://www.techzine.eu/news/security/145550/thousands-of-lovable-apps-are-leaking-personal-data/)
4. [Newsbytes, Security report finds 159,041 Lovable projects exposed sensitive data, 2026](https://www.newsbytesapp.com/news/science/security-report-finds-159041-lovable-projects-exposed-sensitive-data/tldr)
5. [Business Wire via Finviz, CrowdStrike and Lovable Secure the Next Generation of AI-Built Applications, 3 November 2026](https://finviz.com/news/413945/crowdstrike-and-lovable-secure-the-next-generation-of-ai-built-applications)
6. [Briefs.co, Creandum Raises $750 Million for Its Biggest Early-Stage Fund Yet, 2 November 2026](https://www.briefs.co/news/creandum-raises-750-million-for-its-biggest-early-stage-fund/)


---

Lovable hit $600 million in revenue while its apps kept leaking passports — The Inference. Canonical: https://theinference.org/article/lovable-hit-600-million-in-revenue-while-its-apps-kept-leaking-passports