Back to rankings

Lovable Adds Trust Centers to Every Published App

LovableView original changelog

Lovable now automatically generates a trust center for every app published to the public web — a dedicated security page at the app's own address (/.well-known/trust.html) that shows which security controls are actually live, with nothing for the builder to fill in. The page pulls real-time signals such as HTTPS/HSTS enforcement, dependency vulnerability scanning against Google's OSV database, row-level security status, and a CycloneDX software bill of materials. Lovable frames the feature as leveling the playing field for small teams facing B2B security reviews, who previously had no way to prove their security posture without hiring a dedicated security team or commissioning an audit. The trust center currently covers newly published projects, with support for legacy projects and additional data (subprocessors, data residency) coming soon.

Key Takeaways

  • Trust centers are auto-generated, not self-reported — Lovable pulls the data directly from the live deployment rather than letting builders fill in a form, closing a credibility gap common to DIY security questionnaires.
  • The page lives at a predictable, standard path (/.well-known/trust.html) on every publicly published app, making it discoverable by anyone running a security review.
  • Coverage spans four areas: browser/connection security, dependency and deployment integrity (including a CycloneDX SBOM and OSV vulnerability checks), access control (row-level security, database authorization review), and security scanning/remediation status.
  • Lovable explicitly distances the feature from a certification — it displays observed controls and existing certifications but does not itself certify that an app is secure or compliant.
  • The rollout is scoped to newly published apps for now, with legacy-project support and additional data categories (subprocessors, data residency, AI gateway controls) promised as a follow-up.
  • The feature targets small teams without security staff, aiming to give a two-person startup the same B2B-sales credibility signal that previously required hiring a security team or commissioning a formal audit.

Why Trust Centers Exist

Any business selling software eventually runs into a security review: a customer deciding whether to hand over data, an investor doing diligence before a fundraise, or a client's IT team deciding whether to roll a tool out to employees. Historically, the builder's only answer was their word — a filled-in questionnaire or a reassuring email, with no direct way for the other side to verify the claims. Established software companies solved this by publishing a single page, a trust center, that answers the standard questions up front: whether data is encrypted in transit and at rest, who the third-party subprocessors are, which compliance certifications (SOC 2, ISO 27001) are held, and how vulnerabilities get reported and fixed.

Building and maintaining a trust center has traditionally required a security team: someone to gather evidence, a budget for an audit, and someone to keep the page current. That put trust centers out of reach for small teams — even ones that were genuinely security-conscious had no way to visibly prove it.

What Lovable Shipped

Starting August 5, 2026, every app published publicly on Lovable (not just to a workspace) automatically gets a trust center at YOURAPPURL/.well-known/trust.html. Lovable reads the controls directly from the deployed app and reports what it finds — the builder's own app code cannot write, edit, or restyle anything on the page, since it is generated entirely by the platform. Lovable explicitly frames this as informational rather than a certification: the page shows observed controls and existing certifications, but having one does not itself mean an app is secure or compliant.

What Appears on the Page

The trust center is organized into several categories. Under connection and browser security, it reports HTTPS enforcement and automatic redirect from HTTP, Strict Transport Security (HSTS), valid TLS certificates, protection against MIME-sniffing and clickjacking, Content Security Policy rules, referrer policy, browser permissions policy, and secure/same-site cookie protections.

A second category covers dependencies and deployment: Lovable checks the app's dependency inventory against OSV (Google's public open-source vulnerability database), publishes a machine-readable CycloneDX software bill of materials, confirms the inventory matches the current published revision, and links the whole report to the exact deployment's content hash and timestamp. Scheduled health checks monitor uptime.

A third category covers access control — whether a database authorization review has completed for the current revision, and whether every table in the public schema has row-level security enabled. A final category reports security scanning and remediation status, including whether automated security fixes are enabled and whether a connected Aikido assessment has synced.

Lovable says more categories are coming, including backend service details, data residency, AI gateway controls, and a full subprocessor list.

Rollout

The feature currently applies to newly published projects; legacy projects will gain trust centers shortly, per Lovable. An example page is live at https://parisian-scribe-app.lovable.app/.well-known/trust.html.