September 2026 Summaries

Lovable’s EU inference setting, available to Enterprise customers, routes supported AI model requests to designated European endpoints during application development and through supported Lovable AI features in published apps, failing requests when no permitted endpoint is available rather than processing them outside the configured boundary. It addresses where AI models process prompts and context, rather than data residency or application storage, which are managed separately and may require distinct controls. The setting has limitations: Claude can be used during development but not in published apps through Lovable AI, direct integrations with external AI providers are not covered, Microsoft-hosted models may process requests in European non-EU countries, and web search, webpage retrieval, and browser automation continue to use US services. Enabling EU inference also disables certain functions such as video generation, voice conversations, and some image editing, may require existing apps to switch unsupported models, increases AI credit usage, and does not ensure that all network traffic remains within the EU. Workspace owners or administrators can enable the feature, with changes generally taking about 20 minutes to apply, and organizations are advised to evaluate their required AI features, storage needs, geographic policies, and model availability before adoption.

Lovable identified and reported CVE-2026-102989, a TanStack Start vulnerability that could allow specially crafted links to execute unwanted JavaScript in affected apps when opened by visitors, potentially accessing information or performing actions with their permissions. The issue, discovered on September 14, 2026, did not affect every project using TanStack Start, and Lovable reported no evidence of exploitation in reviewed logs. While TanStack prepared an upstream fix, Lovable deployed and refined firewall protections for apps hosted on its platform and coordinated disclosure with the framework’s maintainers. Affected hosted projects will automatically receive the patched version when users next make a change, or they can apply the update free through the project Security page, while new projects already use the corrected version. Lovable will notify affected customers by email, whereas users hosting applications elsewhere must apply TanStack’s update and redeploy through their own hosting environment.

Lovable is partnering with Microsoft to help organizations deploy applications built with Lovable directly within their Microsoft Entra tenants using Copilot Managed Runtime, allowing employees to access them with existing work credentials and IT teams to govern them under familiar policies and app inventories. The integration supports building apps that securely read from and write to Microsoft 365 services such as Outlook, Teams, SharePoint, OneDrive, and Excel, as well as Microsoft Fabric, Dataverse, SQL, and Dynamics-related data without exporting it. Lovable also offers Microsoft Entra ID authentication, availability through the Microsoft Marketplace and MCP Center, and a Windows desktop app, while its Business and Enterprise plans include SSO, SCIM, security scanning, and audit logs. The approach is intended to let teams rapidly create operational tools, such as invoice-processing apps, mobile task trackers, spreadsheet-based workflow tools, and Fabric-powered reports, while preserving enterprise governance and enabling engineers to work with the resulting code.

Lovable now offers free conversational access that lets users explore product ideas, evaluate customer feedback, improve existing applications, and generate plans or changes before committing to development. Users can ask it to compare business models, challenge assumptions, analyze an app’s onboarding or functionality, create multiple design drafts, and continue refining requests through text or voice interaction. Beyond app development, it can draft launch emails, internal documentation, client proposals, and team updates using information from connected tools such as Notion, Granola, and Linear. Lovable can also inspect application code and Lovable Cloud databases, help diagnose usage costs, map and implement new features, and reuse successful components across projects. Free, Pro, and Business workspaces include a daily free chat allowance, while image, video, planning, and building tasks consume credits, with current pricing terms stated to apply through October 31, 2026.

Lovable has joined AWS, CrowdStrike, Databricks, Docker, Google Cloud, Okta, Proofpoint, Salesforce, ServiceNow, Wiz, and Zscaler as a founding member of the Blueprint Alliance, which is developing an open reference architecture for enterprise AI-agent security and governance across multiple vendors and systems. The framework addresses four central needs: discovering and cataloging both internally built, imported, and unregistered “shadow” agents; assigning each agent a traceable identity, owner, and task-specific access boundaries; enforcing policies and monitoring activity through execution-path gateways; and responding to incidents with targeted measures such as revoking tokens, ending sessions, quarantining networks, or terminating affected services. It also emphasizes mapping the broad range of resources agents may access, from data stores and SaaS applications to browsers, payment systems, models, and privileged infrastructure, in order to understand potential exposure. Lovable says its participation will help establish shared standards for agent identity, access control, accountability, and monitoring, with the aim of improving security for its platform and applications built on it as AI agents assume greater responsibility.

Lovable has acquired Sutro, a company whose team spent five years developing a language, compiler, and backend platform designed to make application behavior, rules, security, and reliability more explicit. The acquisition reflects Lovable’s aim to help more people build and deploy trustworthy software without needing to manage all of its underlying complexity. Sutro founder Tomas Halgas and engineers Max Gfeller, Tony Zhan, and Hirad Arshadi will join Lovable, with Halgas leading technical evangelism focused on making the platform’s technology more understandable for builders.

Lovable and Salesforce have partnered to let teams build custom applications and AI agents around Salesforce data using Headless 360, while preserving Salesforce identity controls, permissions, compliance, and its role as the system of record. Lovable apps can read and write core Salesforce objects through individual user accounts, while read-only dashboards and pipeline views can be published directly inside Salesforce with live data; write-enabled apps operate through Lovable’s connector. The integration also brings Lovable into Slack, where users can request apps in natural language, collaborate on builds through Slack Code channels, and create workspace agents for tasks such as quote approvals or account updates. The companies present the approach as a way to eliminate duplicate data, manual re-entry, and separate logins while retaining enterprise controls including SSO, SCIM, security scanning, audit logs, approved connectors, and versioned code. Available immediately, the offering aims to enable business teams to quickly create Salesforce-connected tools and agents that fit their existing workflows.

Lovable has introduced OJ, or Orange Juice, a Rust-based, Vite-compatible development server designed to make its large-scale live app previews faster and less memory-intensive. Unlike traditional Vite instances, which rely on Node.js runtimes and project-installed toolchains, OJ runs as a single binary, reads existing Vite configurations, supports plugins through a compatibility bridge, and uses a Node sidecar only when JavaScript functionality is required. Its architecture is tailored to agent-driven editing by combining file watching, compilation, module graph updates, and hot reloads into a synchronized process that can batch rapid changes rather than showing intermediate states. Benchmarks on synthetic and real-world projects such as Excalidraw and Twenty indicate substantially faster cold starts and memory use ranging from roughly one-third to one-eighth of Vite’s, although comparisons include caveats related to unsupported Vite plugins. Production tests at Lovable showed median preview load time declining from 17.4 to 8.0 seconds and sandbox acquisition falling from 14.5 to 3.0 seconds. OJ is being rolled out gradually to preserve compatibility, requires no changes from builders, and has been open-sourced under Lovable’s GitHub organization for public use and contributions.

Lovable has launched its Partner Program to connect companies seeking AI-enabled software solutions with independent builders, agencies, consultancies, and systems integrators using its platform. The program includes Expert and Solution Partner tracks, certifications based on shipped work, a directory for prospective clients, referral commissions, and varying levels of support and co-selling opportunities. Lovable says more than 800,000 individuals and agencies already use the platform for client work, while over 500 solution partners, including Deutsche Telekom and KPMG, signed agreements or began certification before launch. Survey findings cited by the company suggest that Lovable has enabled new income and career paths globally, including for people without prior software-development experience, while helping builders undertake a wider range of projects such as internal tools, SaaS products, automations, analytics systems, and client portals. Case studies describe agencies and consultancies using the platform to grow operations, accelerate delivery, and create custom software for organizations ranging from local businesses to government and enterprise clients.

Drafts let users create separate, parallel versions of a project to test changes to layout, design, copy, media, and interactive front-end elements without affecting the live application until the draft is accepted and published. Each draft has its own chat and preview, allowing collaborators such as teammates, clients, or copywriters to explore ideas directly in the project while the owner retains control over what goes live. Users can create unlimited drafts, compare alternatives, accept a preferred version, revert changes, or delete and recreate drafts as needed. The initial release supports projects with or without databases and focuses on front-end changes, while database schema and login configuration changes must still be made in the main project chat; drafts also currently use the published application’s database.