AI builder · default hosting *.lovable.app
Lovable builds React applications from a chat prompt and publishes them on its own hosting. It is one of the easiest builders to recognise, because the generated project keeps loading a script from the platform even after the site is exported or moved to a custom domain.
That is not a flaw in Lovable. It is how the editor keeps working on a live project. It does mean a Lovable site is rarely anonymous.
The verdict and the evidence are free. The improvement report needs a free account.
gpteng.co. Lovable projects load their editor script from that host.*.lovable.app is hosted by Lovable itself.lovable. Projects that were never renamed still carry "Lovable Project" as the page title or the OpenGraph title./assets/ and search for lovable: the runtime package name is usually still in there.These are the rules enabled in the database right now, with the weight each one carries. A single strong match is enough to name the builder; the weights decide how confident the verdict is.
| Rule | Where it looks | What it matches | Weight |
|---|---|---|---|
| Lovable / GPT Engineer script host | the host a script is loaded from | (^|\.)gpteng\.co$ | 100 |
| Lovable hosting domain | the site address | (^|\.)lovable(project)?\.app$ | 100 |
| Lovable generator meta tag | the generator meta tag | lovable | 100 |
| Lovable project badge or backlink | the page source | lovable-badge|lovable\.dev/projects|lovable\.app/projects|data-lovable | 90 |
| Lovable default OpenGraph image | a meta tag | lovable\.dev/opengraph|gpteng\.co/[^"\s]*og | 85 |
| Lovable runtime package in the JS bundle | the JavaScript bundle | @lovable\.dev/|gptengineer|gpt-eng\.com|lovable-tagger | 85 |
| Link to lovable.dev inside the JS bundle | the JavaScript bundle | https?://lovable\.dev | 60 |
Lovable projects often talk to Supabase or another backend straight from the browser, so the key ends up in a file anyone can download. If that key is a service role key rather than an anonymous one, the whole database is readable. Our scanner downloads up to three bundles and reports any key it finds, redacted.
The page ships an empty <div id="root"> and builds itself with JavaScript. Google renders most pages eventually, but other crawlers and link previews do not, so the site can look blank to them.
"Lovable Project" or a generic description in the tab and in shared links tells everyone how the site was made, and costs clicks in search results.
Not by itself. What hurts is what usually comes with it: an empty HTML shell, a missing or default meta description, no canonical URL and no structured data. All of those are fixable without leaving Lovable.
Partly. You can remove the badge, rename the title, and move to a custom domain. The editor script and the bundle markers stay unless you export the project and host it yourself.
For most sites, no. It matters if you sell websites to clients, or if a leaked API key turns the marker into a starting point for someone looking for an easy target.
