Bolt.new showed in-browser WebContainer spikes. Lovable (lovable.dev; historically related to GPT-Engineer-class “describe an app” tools) is the sibling that usually opines harder on full-stack hosting: chat + visual edit toward a working web app, often with a hosted backend/auth/database partner (commonly Supabase-class—verify current integrations). It is aimed at founders and PMs as much as engineers. Vol. 21 coding assistants still say: human owns security and diffs.
Vol. 18 deployment / auth patterns still apply when you outgrow the magic path. Vol. 15 HITL: the chat agent must not silently change production RLS policies without review. Next: Replit AI—cloud workspace + deploy in one vendor.
Learning Objectives
By the end of this lesson, students should be able to:
- Describe Lovable as an agent-first full-stack app builder (chat + visual), not JetBrains Tab.
- Contrast opinionated hosted backend gravity vs Bolt’s WebContainer vs Replit’s cloud VM.
- List lock-in and privacy risks: generated schema, vendor chat logs, dummy vs real PII.
- Plan git export / code ownership before calling the app a company system of record.
- Know when PMs should use Lovable vs when engineers should switch to Cursor/Copilot.
- Refuse treating generated auth/RLS as automatically Vol. 20 compliant.
Lovable is a cloud product that turns natural-language (and visual) instructions into a running web application: UI, client code, and typically wired backend/auth/storage via a partner platform. Iteration happens in a chat/agent loop plus a preview. You can usually sync to GitHub. Lovable is an app generator / builder, not a drop-in replacement for a 10-year monorepo IDE. Plan names and backend partners evolve—read the current docs; do not invent prices or unpublished internals.
Agentic Builder vs Autocomplete IDE
| Question | Lovable | Cursor / Copilot |
|---|---|---|
| Who is the primary user? | Founder / PM / full-stack generalist | Professional developer in an existing repo |
| Default motion | Agent writes the app | Human writes; model completes / patches |
| Backend | Opinionated hosted stack | Whatever the repo already uses |
| Autocomplete? | Not the headline (some inline edit) | Tab is core |
| Graduation path | Export/sync → engineers take over | Already there |
Lovable shines
- CRUD MVPs with auth + DB
- Stakeholder demos this week
- Visual tweak + regenerate
Engineers still needed
- RLS / auth threat model (Vol. 20)
- Cost, migrations, observability
- Non-template domains (healthcare, finance)
Switch to an IDE when
- Custom protocols / native deps
- Multi-service architecture
- Regulated data in the loop
Privacy, Schema, and “Repo” Context
Context is mostly your prompts + the generated project + connected backend. That is a cloud copy of schema and possibly user data if you point it at real environments. Use dummy tenants. Do not paste medical or financial dumps “so the AI understands.” Review generated Row Level Security / auth as if a junior engineer wrote them—because an agent did. GitHub sync is your escape hatch; confirm you actually have export rights on your plan.
Catalog Snapshot (Qualitative)
| Dimension | Lovable | Bolt.new | Replit AI |
|---|---|---|---|
| Pricing posture | Seat + generation/credit meters (confirm live) | Seat + generation/token meters | Workspace subscription + Agent usage |
| Strengths | Full-stack opinions (UI + hosted backend/auth); PM-friendly; GitHub sync; fast CRUD | In-browser runtime; JS spike purity; StackBlitz preview | Multi-language cloud VM; collab; deploy-in-place |
| Weaknesses | Stack lock-in; not a daily monorepo IDE; generated security needs review | WebContainer limits; less hosted-DB magic | Cloud residency; less opinionated pretty-UI path than Lovable |
| Agentic vs autocomplete | Agent-first builder | Agent-first builder | Agent + editor assistant |
| Privacy / context | Cloud builder + backend tenant; dummy data; review RLS | Prompt hygiene + WebContainer | Cloud workspace policy |
MVP Brief + Security Review Sketch
When to Pick Lovable
Pick Lovable when
- The buyer is a PM/founder needing auth+CRUD this week.
- Hosted backend opinions (Supabase-class) match the product.
- You have an explicit graduation plan to git + engineers.
- Data in the builder is dummy/synthetic.
Pick something else when
- In-browser JS spike only → Bolt.
- Classroom multiplayer many languages → Replit.
- Existing codebase → Cursor / Copilot / Claude Code.
- Regulated production data in the loop → do not prototype there.
Related Lectures
| Lecture | Role |
|---|---|
| Bolt.new | WebContainer sibling builder |
| Coding assistants | HITL ownership of generated code |
| HITL | RLS/auth changes need a human |
| Deployment / authentication | Graduation path |
| Privacy / security | Dummy data + threat model |
“Lovable is a coding assistant like Copilot Tab.” It is an app generator. Second: generated RLS is correct by construction. Third: you do not need git because the vendor is the source of truth forever. Fourth: real student/patient data makes better demos. Fifth: inventing per-credit dollar prices. Sixth: Lovable replaces Vol. 18 authentication design.
Knowledge Check
- Short Answer: Who is Lovable’s primary user compared to Cursor? Answer: Founder/PM/generalist generating an app, vs a developer in an existing repo.
- True/False: Lovable’s headline mode is JetBrains ghost text. Answer: False—agent-first full-stack builder.
- Multiple Choice: A common strength is: (a) opinionated UI + hosted backend/auth, (b) CUDA kernel tuning, (c) n8n self-host. Answer: (a).
- Short Answer: What must a human review before real users? Answer: Auth/RLS (and keys not in the browser); dummy data only in the builder.
- True/False: GitHub export/sync is part of avoiding vendor lock-in. Answer: True.
- Multiple Choice: Pricing posture is: (a) seats + generation/credits, (b) a memorized $29 price, (c) only Anthropic tokens. Answer: (a).
- Short Answer: When pick Bolt instead? Answer: In-browser JS/TS spike without hosted-DB opinions / WebContainer preview focus.
- True/False: Real PII in the Lovable tenant is recommended for realism. Answer: False.
- Multiple Choice: Graduation path is: (a) git + Vol. 18 deploy, (b) leave preview as prod forever, (c) skip review. Answer: (a).
- Short Answer: Next lecture in 22.6? Answer: Replit AI.
Key Takeaways
- Lovable is an agent-first full-stack builder for MVPs—not Copilot Tab.
- Hosted backend opinions speed CRUD and create lock-in + RLS review work.
- Dummy data, git export, and Vol. 18 graduation are non-optional.
- Pick Bolt for WebContainer spikes, Replit for cloud collab VMs, IDEs for real repos.
- Next: Replit AI.
Lab: Same study-group MVP brief. Students screenshot RLS policies and mark two risks. Export to GitHub if the plan allows.
Role play: PM wants to connect the school SIS. Expected refusal: dummy data only; regulated ingest is an engineering + Vol. 20 project, not a Lovable prompt.
Recap: Lovable is the opinionated full-stack cousin of Bolt—great for dummy-data MVPs, dangerous as unreviewed prod auth. Continue to Replit AI.