FeatureLovable Vibe Builder Non Technical

Lovable generates Trust Centers for published apps

By Harsh Desai13 August 2026

TL;DR

Lovable automatically generates a Trust Center security page at /.well-known/trust.html for every publicly published app along with a JSON twin listing observed security facts.

What changed

Lovable now automatically generates a Trust Center security page at /.well-known/trust.html for every publicly published app along with a JSON twin that lists observed security facts. Developers notice this addition appears without any extra configuration steps. Vibe Builders and Basic Users can reach the page directly via the app URL.

Why it matters

Developers publishing apps gain an edge over competitors like Vercel that require separate manual security page creation. In use cases such as sharing apps with teams this provides instant facts on observed security. Vibe Builders can focus on app creation rather than documentation tasks.

What to watch for

Compare the generated page against alternatives like manual setups in Replit to see differences in detail level. Developers should verify the JSON content by visiting the /.well-known/trust.json endpoint after publishing an app.

Who this matters for

Vibe Builders: Share your published app URL with buyers to show instant, automated compliance proof.
Basic Users: Check any app's security details directly by adding /.well-known/trust.html to its domain.

Harsh’s take

Automated security compliance is a smart growth hack for web builders. By serving machine-readable security claims at a standard well-known endpoint, Lovable eliminates manual documentation work for non-technical creators. While this feature outpaces static hosting platforms that require custom security pages, builders must still verify the generated JSON facts. Relying solely on automated pages without auditing underlying data risks misrepresenting enterprise readiness.

by Harsh Desai

Source:docs.lovable.dev