I just heard Lovable is near 8M users—so why the 40% traffic drop and no ARR?

Why This Matters Right Now

Lovable, a Stockholm-based AI coding platform built for “vibe coding” (natural language to app generation), says it’s nearing 8 million users and sees 100,000 new products built daily. That’s a big jump from the 2.3 million active users reported in July and comes after $228 million raised and a $1.8 billion valuation. The catch: CEO Anton Osika declined to confirm current ARR, even though the company publicized $100 million ARR in June, and external data shows traffic fell ~40% by September. For operators, the signal is rapid adoption and enterprise interest-tempered by unanswered revenue questions, sustainability concerns, and ongoing security risk.

Key Takeaways for Decision‑Makers

• Reported scale: ~8M users and 100k daily “products” suggests strong top‑of‑funnel, but revenue health is opaque without current ARR.
• Growth quality: Barclays flagged a ~40% traffic decline since an early‑year peak; expect volatility in consumer and prosumer usage.
• Enterprise pull: Osika says more than half of the Fortune 500 use Lovable, but likely for evaluation and prototyping vs. production.
• Retention: Claimed net dollar retention >100% is positive but unaudited; understand what counts as “spend” in a consumption-led model.
• Risk center: Security is the fastest-growing hiring area after a sector incident leaking 72,000 images; pre-deploy checks exist, but sensitive apps still require expert review.

Breaking Down the Announcement

Lovable’s headline metrics-user count and daily products-underscore engagement but don’t answer the core CFO question: What revenue and margin profile follows? The company reports >100% net dollar retention (NDR), which typically signals expansion within existing customers. that said, NDR can mask churn when new-seat growth and usage spikes offset contraction elsewhere. Without updated ARR, it’s difficult to separate sustained enterprise adoption from transient experimentation.

Osika says Lovable just passed 100 employees and is bringing leadership talent from San Francisco to Stockholm—signs of scale-up intent. He also claims more than half of the Fortune 500 have used Lovable to “supercharge creativity.” In practice, that likely ranges from hackathon-style internal pilots to lightweight tools, not necessarily mission-critical deployments. The company’s stated focus is enabling the 99% of non-coders to build software, positioning Lovable more as a product creation surface than a developer IDE.

Industry Context: Vibe Coding’s Hype Cycle

Barclays’ research and trend data indicate traffic to several vibecoding tools, including Lovable and Vercel’s v0, cooled after early peaks. That’s normal for new creation paradigms—the initial curiosity spike gives way to more measured, ROI-driven adoption. The strategic question for 2025 budgets is whether vibecoding shifts from demos to durable workflows. The answer likely varies by use case: rapid prototyping, internal tools, and marketing microsites are near-term fits; regulated, customer-facing systems remain high risk.

Security, Compliance, and the Real Risks

Osika acknowledged a recent sector incident where an app built with vibecoding tools leaked 72,000 images, including GPS data and user IDs. Lovable now runs multiple security checks before deployment and recommends security experts for sensitive apps. That’s directionally right—but it means the platform alone is not your control surface. If you adopt Lovable, treat it as a generator plugged into your existing SDLC and security stack, not a bypass.

• Mandate code scanning (SAST), dependency checks (SCA), and dynamic testing (DAST) before any production deploy.
• Block PII/PHI until data classification, masking, and logging are configured; enforce least-privilege API keys in generated apps.
• Require audit trails, source export, and version control integration; no “deploy from prompt” without change management.
• Ask for third-party attestations (e.g., SOC 2), recent pentest reports, and incident response SLAs.

Competitive Angle and Supplier Risk

Lovable runs on models from providers like OpenAI and Anthropic, which also offer their own coding agents. That creates platform risk: if model vendors close product gaps or change pricing/terms, downstream platforms feel it first. Alternatives frame the choice differently: Replit emphasizes an all-in-one developer environment and agents; Vercel’s v0 aligns with the modern web stack; GitHub Copilot suits code-completion inside existing IDEs. Lovable differentiates on end-to-end product creation for non‑coders. Fit depends on whether your goal is enabling product teams to “demo, don’t memo,” or accelerating professional developers inside standard toolchains.

What This Changes for Operators

If the daily “products” figure is directionally accurate, vibecoding is already reshaping ideation and prototyping speed. Expect faster zero-to-one experiments, more bottoms-up tooling, and pressure on design/engineering to validate ideas with users, not slides. But do not mistake a working demo for production readiness. The new operational task is separating prototypes worth hardening from noise—and doing so with security-by-default and clear ownership.

What to Do Next

• Run a 60-90 day pilot in two to three workflows (e.g., internal dashboards, partner portals, content tools). Track time-to-first-prototype, build-to-deploy ratio, and security scan pass rates.
• Demand metrics: monthly active builders, workspace retention, conversion from prototype to maintained app, and seat-level expansion. Request updated ARR and an independent reference from an enterprise similar to yours.
• Negotiate guardrails: data processing addendum, IP ownership of generated code, source export and portability, usage caps, and transparency into model providers used.
• Segment use cases: greenlight non-sensitive internal apps; hold regulated or customer-facing flows until your AppSec sign-off and a hardening pathway exist.

Bottom Line

Lovable’s reported scale and enterprise curiosity are real signals, but the absence of current ARR and a documented traffic dip argue for disciplined adoption. Treat Lovable as a high-velocity prototyping layer with potential to graduate selective workloads—while keeping production standards, security controls, and procurement diligence firmly in place. If the company can convert experimentation into durable enterprise revenue and prove out security maturity, its “anyone can build” thesis will be more than a demo.