Lovable Nears 8M Users in Year One: Enterprise Pivot, 100K Daily Apps, and a Security Push as 'Vibe Coding' Matures

Lovable is closing in on 8 million users after its first year. At Web Summit in Lisbon on November 10, 2025, CEO Anton Osika shared the milestone. The update arrives as Morocco scales practical AI across startups, ministries, and industry.

He said users now create about 100,000 new products on Lovable every day. The year‑old platform is seeing strong experimentation. That cadence matters for teams embracing "memo to demo" workflows.

Funding has powered the push. Lovable has raised $228 million to date, including a $200 million round in the summer at a $1.8 billion valuation. Rumors put a future round near $5 billion, but Osika declined to discuss fundraising.

Osika did not update June's $100 million ARR figure. He pointed instead to quality and stickiness. Net dollar retention exceeds 100% as customers expand spend. Lovable also passed 100 employees and is adding leadership talent in Stockholm.

Enterprise traction is now the center of gravity. Osika said more than half of Fortune 500 companies use Lovable to speed prototyping and iteration. Teams test with users instead of crafting long presentations. The aim is one interface for research, composition, and shipping.

This is the "vibe coding" pitch. Describe your idea, get a working demo, and iterate fast. It removes friction for non‑developers and accelerates product learning cycles.

There are headwinds. Barclays and Google Trends data show traffic softening for leading vibe coding tools, including Lovable and v0. Barclays estimated Lovable's traffic was down about 40% by September.

Lovable counters with retention and enterprise adoption. Those metrics matter more than raw visits for long‑term value. They also align with the needs of regulated buyers.

Security has moved to the front of the roadmap. A recent no‑code app leak exposed 72,000 images, GPS coordinates, and user IDs. Osika acknowledged the sector's risks and said Lovable is hiring security engineers aggressively.

He added new guardrails. Lovable now runs multiple security checks before deployment. It also requires customers building sensitive applications, such as banking, to engage security experts. That mirrors traditional development workflows.

Why this matters for Morocco. The country's AI agenda is pragmatic. Build usable tools, respect data protection, and deliver outcomes in key sectors. Lovable's shift speaks directly to that balance.

Morocco's ecosystem is maturing. UM6P anchors research, applied AI, and venture building. Local datacenters and telecom clouds improve sovereignty options. Startups like Atlan Space show how AI can scale from Morocco to regional missions.

Policy guardrails are in place. The CNDP enforces Law 09‑08 on personal data protection. The DGSSI publishes security baselines, including the General Security Reference. These frameworks guide procurement, audits, and incident response.

Practical use cases fit vibe coding well in Morocco:

Rapid prototypes for citizen services, permits, and payments.

Smart irrigation dashboards for cooperatives using satellite and sensor data.

Tourism apps with Arabic and French support for bookings and itineraries.

Port and logistics planners for yard allocation and gate flows.

Health triage tools and scheduling assistants in clinics.

Education portals that automate grading and feedback.

Energy monitoring for plants and solar farms.

Localization is critical. Arabic and French must be first‑class. Darija support improves adoption in field teams. Accessibility, offline‑first design, and low‑bandwidth performance matter outside big cities.

Moroccan buyers should treat vibe coding platforms like any software supplier. Verify security, availability, and compliance. Require transparency on model providers, data handling, and deployment options. Document how code is generated, stored, and tested.

A lightweight checklist helps.

Map data classes against Law 09‑08 and sector rules.

Decide data residency and backup locations.

Require SSO, MFA, and role‑based access.

Enforce code scanning, dependency checks, and SBOMs.

Run threat models and pen tests before go‑live.

Validate logs, audit trails, and incident playbooks.

Plan vendor exit and code export.

Model choices deserve scrutiny. Lovable uses models from OpenAI and Anthropic. That raises data locality and vendor risk questions for regulated workloads. Morocco's teams should evaluate regional hosting and model alternatives where needed.

Ask practical questions.

Can we route prompts and code generation through EU or regional clouds?

What fine‑tuning data leaves Morocco, if any?

How is customer data masked or redacted during generation?

What happens to our code if a provider changes terms?

Procurement needs matching clarity. Keep contracts explicit on IP ownership, code portability, and uptime. Require security certifications, such as ISO 27001 or SOC 2, where relevant. Align SLAs with business impact, not marketing promises.

A 30‑60‑90 day plan can de‑risk adoption.

Days 1–30: Run a sandbox pilot with non‑sensitive workflows. Measure build time and defect rates. Establish guardrails and approvals.

Days 31–60: Expand to a cross‑functional pilot. Add security scanning and seed a design system. Localize flows for Arabic and French.

Days 61–90: Move one production‑grade app through controls. Conduct a third‑party security review. Document ROI and decide on scaling.

Talent is the multiplier. Morocco has strong universities and a growing community of builders. UM6P, ENSIAS, and Al Akhawayn produce engineering and data talent. Bootcamps and in‑house academies can train on prompt design, testing, and secure SDLC.

Culture matters as much as tools. Osika's "memo to demo" message applies in Moroccan organizations. Shorten planning cycles, test with users, and ship improvements weekly. Keep governance tight while removing unnecessary blockers.

Measure what matters, not just traffic. Lovable spotlighted retention as a quality signal. Moroccan teams should track operational outcomes.

Lead time from idea to deploy.

Defect escape rate and mean time to recovery.

User task completion and satisfaction.

Security findings per release.

Compliance audit time.

There are limits. Barclays flagged a traffic dip for vibe coding tools. Hype cycles fade. That is healthy. It forces teams to validate durable value and clear ROI.

Lovable's story also shows breadth. Its origins trace to GPT Engineer, an open‑source project that went viral. The product then targeted the 99% who do not code professionally. Users range from an 11‑year‑old in Lisbon to a Swedish duo reportedly making $700,000 annually.

That range matters for Morocco's inclusivity goals. Low‑code tools open doors for civil servants, SME owners, and students. They reduce the cost of trying ideas. Security and governance keep those trials safe.

The vendor landscape will stay fluid. OpenAI and Anthropic power Lovable while launching their own coding agents. More entrants will follow. Choice is good for buyers, but integration discipline is essential.

Where to go next in Morocco. Start with problems, not platforms. Pick two high‑impact workflows and run controlled experiments. Share results across agencies and companies to avoid duplicated effort.

The message from Lisbon is practical. Hypergrowth is exciting, but enterprises decide the outcome. Security and retention point to staying power. Morocco can harness that momentum while keeping trust front and center.

Key takeaways