# Lovable auto-generates a live security page for every public app By Steven Van · 2026-08-10 The Trust Center at /.well-known/trust.html checks HTTPS, dependencies and access controls with no setup and nothing to fill in. Lovable just handed every public app on its platform a feature that usually takes a security hire and months of paperwork: a Trust Center. It is a shareable page with always-current security information about your app, generated and maintained by Lovable itself. Selling to a customer who asks about security? Send the link. Raising money and a diligence checklist lands in your inbox? Send the link. [Lovable]() says no other platform does this yet, and for solo founders and small teams shipping vibe-coded products, it removes one of the most awkward conversations in the sales process. [Source post](https://x.com/i/status/2086798369868087792) ## A security page that lives at your app's own address Every Trust Center lives at a standard path on your app's own domain: `YOURAPPURL/.well-known/trust.html`. If your app is published publicly (not restricted to your workspace), the page exists automatically. There is nothing to enable, no form to fill out, and no separate dashboard to maintain. Lovable links a live example in its announcement so you can see what buyers and investors would see when they open the link. That placement matters more than it looks. The `.well-known` convention is where the web already puts machine-readable facts about a site, and putting security posture there means the page is tied to the running app, not to a marketing site or a PDF that goes stale the week after it is written. ## What the page actually verifies The Trust Center reports on automatically detected controls across three areas. For connection and browser security, it checks HTTPS enforcement and HSTS, valid TLS certificates, Content Security Policy, referrer and permissions policies, secure cookies, and protections against MIME sniffing and clickjacking. For dependencies and deployment, it runs vulnerability scanning against Google's OSV database, publishes a software bill of materials in CycloneDX format, and shows deployment traceability with content hashes and timestamps plus health monitoring status. For access control, it surfaces database authorization reviews and row-level security status, which is exactly the area where vibe-coded apps have historically been burned by exposed data. Lovable also lists what is coming next: data residency details, backend service information, AI gateway controls, and subprocessor lists are all marked as coming soon. ## No questionnaires, and your app code cannot fake it The design principle behind the feature is that you never fill anything in. Lovable reads the security controls straight from your deployed app and shows what it finds, so the page stays current as your app changes. The platform also prevents your app's own code from modifying the Trust Center page, which is what makes the information worth trusting in the first place. Lovable is explicit that this is not a certification: it shows observable controls, not a compliance guarantee like SOC 2. But for an early-stage product, observable controls answered honestly are often exactly what a buyer's security review is trying to establish. ## Built on the Security Checker groundwork Trust Centers extend security work Lovable has been shipping all year. Security Checker 2.0 already scans projects for exposed secrets, misconfigurations, and other risks in real time, and is built as a modular system so new detection rules can roll out as threats evolve. Lovable itself is ISO 27001:2022 certified and aligns its controls to the SOC 2 Trust Services Criteria, with its own company-level trust center at trust.lovable.dev. The new per-app pages effectively pass a slice of that posture down to every builder on the platform. ## Why this matters if you sell what you build The gap between building software and selling software to businesses has always been trust paperwork. Creators and indie founders using AI builders could ship a working product in a weekend, then stall for weeks when a prospect's IT team asked for security documentation. A link that shows live, verifiable controls does not replace SOC 2 for enterprise deals, but it gets small deals unstuck and gives investors a fast signal that the product is not held together with exposed API keys. If you have a public Lovable app right now, your Trust Center already exists. Add `/.well-known/trust.html` to your app URL and see what it says about you. ![Lovable]() Lovable Build software with AI. [View Lovable →]() Sources [Lovable: Trust centers for business](), [Lovable announcement on X](), [Lovable: Where vibe coding meets security]() [Read Lovable auto-generates a live security page for every public app on Creators Toolbox]() --- Canonical source: https://creatorstoolbox.com/blog/lovable-trust-centers