Product1 publisher3 min readPublished
Lovable's CTO says enterprises show up with thousands of apps their staff already built
Fabian Hedin, Lovable's CTO, said two-thirds of the Fortune 500 use the tool because staff found it themselves, and put current revenue at $600m. The permissions work starts after the apps are running.
The Product Desk · Product desk

What happened
- Lovable co-founder and CTO Fabian Hedin said two-thirds of the Fortune 500 are using the product, often because staff inside those companies found it on their own.
- Hedin put Lovable's current revenue at $600m, speaking to Forbes senior editor Iain Martin on Wednesday at HumanX in Amsterdam.
- Deutsche Telekom has built more than 2,000 applications on Lovable, Hedin said.
- Lovable works with CIOs on who should build what, which data each app can reach and who can edit it, because editors indirectly gain access to the data behind an app.
- Lovable creates more than a million projects a week, too many to review by hand, so it scans all of them with AI and keeps scanning after users stop building.
Compiled by The Product DeskSomething wrong?How this is made
Why it matters
- exposure When adoption starts with staff, the first enterprise exercise is discovery on software already in production, and the security team answers for apps it never approved.
- decision CIOs are choosing between routing these requests back into a queue that took months and writing permission rules for tools a sales lead can change in 10 minutes.
- capability By Hedin's account an agent can now navigate an internal permission system that no human knew how to navigate, so misconfigurations that were protected by being unfindable become reachable.
- constraint A customer that has to document which model handled a regulated file cannot get that from Lovable's own controls, because there is no picker to set.
A sales leader at Uber Eats who knew the restaurant pitch process end to end built a tool on Lovable that produced a pitch customized for each restaurant [8]. The first version took a few hours or a day, and later changes about 10 minutes [9]. Changes like those used to wait months on an engineering backlog [10].
The people doing this sit in finance, HR, engineering, product and design [11]. The call to Lovable comes later, when a company has thousands of apps and wants to know what to do about them [2]. Hedin said companies are also replacing costly internal software that offered little customization, and that users own what they build and can take it and run it themselves [23][24].
Martin said revenue was about $200m when he visited the Stockholm company last summer [4], roughly a third of the figure Hedin gave on Wednesday, so revenue has about tripled in half a year [6]. In August, a $400m round valued Lovable at $13.3bn [5]. The report of the session does not break the $600m into company contracts and individual subscriptions [7].
Security teams sometimes worry about all the new code, "rightfully so", Hedin said [15]. He said AI agents also change security inside large companies [16]. "I think before, a lot of people have been able to rely on kind of security by obscurity, where like the permission system internally in a large enterprise has not been perfect, but no one knows how to navigate it. Now you can have an agent navigate it," Hedin said [14].
More than a million new projects a week comes to upwards of 50 million a year for Lovable's scanner to cover [19]. It fixes critical flaws in dependencies and proposes fixes for the rest, and Hedin said the tool is free for all users and the first in its category [18]. Martin raised the pattern of vibe-coded apps that took off and then leaked user data; Hedin said builders have to assume vulnerabilities will exist, and pointed to a flaw recently found in the curl command-line tool [20].
Lovable has never offered a model picker, and for a single task it may use more than 100 models, weighed on cost, speed and quality [21]. Hedin said customers ask for the routing after the industry's talk of token maxing turned into bills [22]. Without a picker, a buyer cannot specify which model handles a given app's data.
The sort that makes the inventory tractable has two axes: how sensitive the data an app reaches is, and how many people hold edit rights on it. Apps in the sensitive-data, many-editor corner are the first block of work, and one team's spreadsheet with a single editor can sit. Reviewing 2,000 apps at five minutes each takes about 167 hours [25].
What to watch
- Whether Lovable publishes what share of the $600m comes from signed company contracts as opposed to individual subscriptions.
- Whether a Fortune 500 customer discloses an incident traced to a staff-built Lovable app and its edit permissions.
- Whether Lovable adds per-app model disclosure or a picker for buyers that need to name what processed their data.