Lovable July 25, 2026 Changelog

If you use Lovable to build apps, you probably use API keys—special passwords that let your app talk to other services. Sometimes people accidentally leave these passwords in public code folders on GitHub. This update is a big deal for anyone who manages a team or builds apps, because it stops hackers from stealing those leaked passwords. Now, if a key goes public, Lovable instantly disables it to keep your workspace safe.

What's new

• Automatic key protection: If an API key (a password that lets your app access other services) is accidentally posted in a public GitHub code folder, GitHub spots it and tells Lovable. Lovable immediately turns off that key so nobody bad can use it.
• Instant email alerts: When a key gets shut down this way, Lovable sends an email to the person who made the key, plus all workspace owners and admins. The email tells you exactly which key was leaked and links to the GitHub warning. These emails always go out, even if you normally have your notification settings turned off.

Improvements

• Cleaner key lists: Once a key is automatically shut down for being leaked, it disappears from your list of active access tokens. This keeps your settings page neat and makes it obvious that the key is gone.

Breaking changes

• Once an API key is automatically revoked (shut off) for being leaked, it cannot be restored. You will have to create a brand-new key to replace it.