Lovable adds abandoned project clean-up to Enterprise plan

What the feature does

According to Lovable, every workspace collects projects that nobody touches anymore: a hackathon prototype, an internal tool built by someone who has since left, or a landing page for a finished campaign. Many remain published and connected to data. The company says this happens across all AI tools and is commonly known as "app sprawl".

The clean-up feature works in two steps. First, Lovable marks a project as abandoned after a period with no activity. The default is 60 days, and both published and unpublished projects are covered. Second, if an admin turns on auto-delete, Lovable deletes abandoned projects after a grace period of 7, 14, or 30 days. Auto-delete is off by default.

Activity counts as use. That includes someone editing the project or chatting with it in the editor, a visitor to the published app (bot traffic is excluded), or a call to the project's backend functions. Opening or previewing a project does not count, and publishing on its own does not reset the clock.

Warnings and recovery

Because deleting someone's work is a big step, Lovable says the feature is built to be careful. Owners and members with edit access receive a warning email and an in-project banner 5 days and 1 day before the deletion date. Anyone with access can stop the deletion by editing the project, sending it a message, or clicking Keep it in the banner or email.

Deleted projects stay recoverable for 60 days. Admins can restore them from Workspace settings → Workspace → Recently deleted projects. When a project is deleted, its published app goes offline and its backend is paused. After 60 days, Lovable permanently deletes the project, its version history, and its chat.

There is one caveat. When a project is deleted, its lovable.app address is freed up. If someone else takes it, the project cannot be restored to that address.

Why abandoned apps are a security issue

Lovable argues that an app can keep running long after people stop using it, with pages still accessible, credentials still working, and a database still holding customer information. It lists four risks:

• Old logins and credentials: a demo built for a customer meeting may still accept sign-ins, and an API key from a quick experiment may still connect to a company system.
• Unfixed vulnerabilities: a signup form built for an event may rely on a software library that later needs a security update, which may never be applied if nobody maintains the app.
• Leftover personal information: last year's waitlist may still contain names, email addresses, and form responses the business no longer needs.
• Lost ownership: when the builder of an internal tracker changes teams or leaves, nobody may be clearly responsible for reviewing access or deciding when to retire the app.

How to turn it on, and the Halloween game

Enterprise admins and owners can set up the feature in Workspace settings → Security → Privacy & security → Abandoned projects. There they choose when projects are marked abandoned (the default is 60 days), then switch on auto-delete and pick a grace period of 7, 14, or 30 days.

Lovable also built a free game in Lovable where users hunt for undead apps. The game uses fictional projects, and playing does not access or delete real projects. Actual clean-up is configured separately through the Enterprise settings.

For organizations on the Enterprise plan, the feature offers a way to retire unused apps on a schedule, with warnings and a recovery window, rather than relying on someone to remember them.