You described what you wanted, Lovable built it, and it works. That is a genuinely finished prototype — and the gap between a prototype and something real people can trust is not more features. It is the part underneath: who can get at the data, where the keys live, and what happens on the day something breaks.
These come up again and again — not because the tool is bad, but because they are invisible until someone goes looking.
Anything the browser needs, the browser can be asked for — and an API key pasted into the frontend during a build session is readable by anyone who opens developer tools. Roughly one in nine scanned indie apps exposes database keys this way.
Secrets are encrypted per app and per environment and injected at runtime. They never enter the code, never reach the bundle, and never get pasted into a chat.
A screen can look private and still answer anyone who requests the data behind it. Sign-in that was scaffolded quickly tends to protect the interface rather than the records, which is why 45% of AI-generated code carries an OWASP Top-10 vulnerability.
A hosted sign-in page, your own user list, roles that decide who sees what, and multi-factor authentication — managed rather than hand-rolled, so the check happens on the server every time.
An export you took once is not a backup, and a backup nobody has restored is a guess. The first time most people test recovery is the day they need it.
Backups run on a schedule around the clock, are verified by actually restoring them, and are stored encrypted. Recovery is a single action.
Each change is another chance to publish a credential or a broken permission, and the deploy that does it looks exactly like the one before.
Automatic secret scanning runs on every deploy and blocks a release that would expose credentials — on every plan. Continuous automated penetration testing ships to Pro when it lands.
You keep building in Lovable. Softkiln is what runs the result: nothing about how you make changes has to change.
Your app and its backups run in the EU by default, on your own domain with the certificate renewed for you, watched around the clock with a public status page.
No. Keep describing changes in Lovable exactly as you do now. Softkiln runs the result — it is the environment your app lives in, not a different way of building it.
Your application and its data. Softkiln provisions the database, the separate development and production environments, and the web address, then injects your keys at runtime instead of leaving them in the code.
Minutes for a first deploy, and the 15-day trial starts without a card. Adding your own domain and issuing its certificate is one more step, done for you.
Figures from the research linked on the home page. More questions in the FAQ.