Lovable (formerly GPT Engineer) has become one of the most significant AI builders in 2024-2025, surpassing 1 million users and powering thousands of SaaS prototypes, internal tools, and web applications. Unlike website builders like Framer or Webflow, Lovable generates full-stack React applications — complete with databases, authentication, and backend logic.

This guide covers every technical signal Lovable leaves behind and how to identify Lovable-built apps manually or automatically.

What Is Lovable?

Lovable is an AI-powered full-stack application generator. You describe an app in natural language — “build me a project management tool with Kanban boards, user accounts, and team collaboration” — and Lovable generates a complete React application backed by a Supabase database.

This makes Lovable fundamentally different from page-based builders:

  • Webflow and Framer create marketing websites and landing pages
  • Lovable creates interactive web applications with real backends

    • The technical architecture that enables this also creates distinctive fingerprints.

    —

    Signal 1: Lovable Uploads S3 Domain (Very High Confidence)

    The most reliable Lovable detection signal is the S3 storage domain used for user-uploaded files:

    lovable-uploads.s3.amazonaws.com

    Every Lovable project that allows file uploads — including profile photos, images in the app, or any user-generated content — stores files in this S3 bucket. If a site makes network requests to lovable-uploads.s3.amazonaws.com, it was almost certainly built with Lovable.

    How to check:

  • Open DevTools → Network tab
  • Reload the page
  • Search for lovable-uploads in the filter box
  • Any matching request confirms Lovable

    • —

    Signal 2: Lovable Default Domains (Very High Confidence)

    Apps published on Lovable’s infrastructure use one of these default domain patterns:

  • [project-name].lovable.app — the most common default domain
  • [hash].lovable.dev — used for development previews

    • If a site’s canonical URL or any internal redirect points to *.lovable.app, the site is definitively built with Lovable. Even after connecting a custom domain, the lovable.app origin may appear in network requests or redirects.

    —

    Signal 3: Supabase Infrastructure (Medium-High Confidence)

    Lovable uses Supabase as its backend database and authentication provider for every project. Apps built with Lovable make API calls to Supabase:

  • [project-ref].supabase.co — Supabase API calls
  • [project-ref].supabase.co/auth/v1/... — authentication endpoints
  • [project-ref].supabase.co/rest/v1/... — database REST API

    • However, many non-Lovable developers also use Supabase, so this signal alone is not conclusive. It becomes high-confidence when combined with other Lovable signals.

    How to check:

  • Open DevTools → Network tab
  • Filter by supabase.co
  • If Supabase calls appear alongside other Lovable signals, confidence increases significantly

    • —

    Signal 4: Lovable Script References and HTML Markers

    Lovable-generated React apps often include references to the Lovable platform in their source:

  • data-lovable HTML attributes in some generated component scaffolding
  • lovable-tagger — a development-mode script that tags components for the Lovable editor
  • References to lovable.app in the page’s canonical URL or meta tags

    • The lovable-tagger package is particularly distinctive — it’s a Lovable-specific development tool not used by any other platform.

    In page source, look for: 

    <meta name="generator" content="Lovable">

    or references to lovable-tagger in script sources.

    —

    Signal 5: React + Vite Architecture (Supporting Signal)

    Lovable generates React applications built with Vite. The presence of Vite’s build output patterns — specifically /assets/index-[hash].js and /assets/index-[hash].css file naming — combined with other Lovable signals increases confidence.

    Standalone React + Vite is used by many developers, so this isn’t conclusive alone. But it’s consistent with Lovable’s architecture and helps confirm when other signals are present.

    —

    Signal 6: Package Fingerprints in Bundle

    Lovable’s generated code consistently uses a specific set of npm packages that appear in the JavaScript bundle:

  • shadcn/ui — Lovable’s primary UI component library
  • Tanstack Query (React Query) — for data fetching
  • React Router — for client-side routing
  • Lucide React — for icons
  • Tailwind CSS — for styling

    • While each of these is used independently by developers, the combination of all five in a single app is strongly associated with Lovable’s code generation templates.

    —

    How to Detect Lovable Manually (Step-by-Step)

    Method 1: Network Tab Check (Most Reliable)

  • Open the website or app
  • Press F12 to open DevTools
  • Click the Network tab
  • Press Ctrl+R / Cmd+R to reload
  • In the filter field, type lovable
  • Look for requests to lovable-uploads.s3.amazonaws.com or lovable.app
  • If found → confirmed Lovable

    • Method 2: URL Inspection

  • Check the URL bar — if it contains *.lovable.app, it’s a Lovable project
  • Check canonical tags: view source (Ctrl+U) and search for canonical
  • Look for redirects: lovable.app may appear in a redirect chain even on custom domains

    • Method 3: View Page Source

  • Press Ctrl+U to view source
  • Search (Ctrl+F) for lovable — look for generator tags, script references, or lovable.app URLs
  • Search for lovable-uploads to find S3 references in image tags

    • Method 4: Check the App’s Authentication Flow

    Lovable uses Supabase Auth. If you can:

  • Open DevTools → Network tab
  • Click the “Sign In” or “Log In” button on the app
  • Watch for requests to *.supabase.co/auth/v1/
  • Combined with other signals, this points strongly to Lovable

    • —

    Lovable vs. Bolt vs. Replit: Detection Differences

    All three are AI app builders, but they leave different fingerprints:

    | Signal | Lovable | Bolt.new | Replit |

    |—|—|—|—|

    | Default domain | *.lovable.app | *.stackblitz.io | *.repl.co |

    | Storage CDN | lovable-uploads.s3 | StackBlitz CDN | Replit CDN |

    | Backend | Supabase | Various | Replit DB |

    | Framework | React + Vite | Various | Various |

    | Detectability | High | Medium | High |

    Lovable is generally easier to detect than Bolt because Lovable uses a consistent infrastructure (Supabase + specific S3 bucket), while Bolt.new produces more varied output.

    —

    Why Lovable Detection Matters

    Competitive analysis: If a startup’s product looks impressive and was built quickly, knowing they used Lovable helps you understand their development timeline and technical decisions.

    Technical due diligence: For investors or acquirers, knowing a product runs on Lovable’s generated Supabase backend has implications for scalability and maintainability.

    Inspiration and replication: Seeing a Lovable-built app with a feature you want helps you know you can build something similar quickly.

    Stack research: Developers often want to understand what technology stack powers tools they admire.

    —

    How Common Are Lovable Sites?

    Lovable crossed 1 million users in late 2024 and has been growing rapidly. In our scan database, Lovable is one of the top 10 most frequently detected AI builders, with prevalence increasing month over month.

    The platform is particularly popular for:

  • SaaS MVP prototypes
  • Internal business tools
  • Portfolio projects and hackathon entries
  • Early-stage startup products

    • —

    Frequently Asked Questions

    Can Lovable apps hide their fingerprints?

    Partially. A developer who exports the code and self-hosts it (not using Lovable’s hosting) can remove the domain signals. However, if they continue using Supabase (which is deeply integrated into Lovable’s generated code), the Supabase API calls remain. Replacing Supabase would require significant refactoring. The S3 upload bucket (lovable-uploads.s3) is particularly hard to change without rewriting all file upload logic.

    Is every app using Supabase a Lovable app?

    No. Supabase is a popular open-source database platform used by many developers independently. Supabase alone is not a Lovable signal — it becomes a Lovable indicator only when combined with the lovable-uploads.s3 domain, lovable.app domains, or other Lovable-specific signals.

    What’s the difference between Lovable and GPT Engineer?

    They’re the same product. The company rebranded from GPT Engineer to Lovable in late 2023. Older projects may still use gptengineer.app domains — that’s the same platform under the previous name.

    How accurate is Lovable detection?

    When lovable-uploads.s3.amazonaws.com or *.lovable.app are present, detection accuracy is 95%+. Without these primary signals, detection relies on secondary signals (Supabase + React + Vite + shadcn) and accuracy drops to 60-75%. This is why the confidence score varies between Lovable sites.

    Can I check any website for Lovable automatically?

    Yes — paste the URL into AI Website Detector for an instant result. Our engine checks all Lovable signals simultaneously: S3 domain, hosting patterns, HTML markers, Supabase connections, and JavaScript bundle fingerprints.