Lovable, the AI app builder that lets non-developers create software through natural language, is rethinking security from the ground up because traditional hard rules don't work when AI agents can route around them. Igor Andriushchenko, Head of Security and Chief Information Security Officer (CISO) at Lovable, explained in a recent interview how the company balances rapid scaling with protecting users who have never thought about security in their lives.

The challenge is acute. Lovable grew from roughly 40 people to managing about 400 laptops in mobile device management (MDM) within a year, while simultaneously handing software creation tools to people with no development background. Andriushchenko's security team expanded from one person to around 25, with more offers out, forcing the company to build security infrastructure for a company it knew would be 10 to 15 times larger than it was when he arrived.

Why Traditional Security Controls Are Breaking Down?

The traditional approach to security relies on deterministic controls, where rules either match or they don't. Static analysis tools worked because the world was deterministic. But AI changes that equation. When an AI agent can understand intent, context, and a user's role, it can make judgments that hard rules cannot. Andriushchenko compared this shift to the difference between static rules and onboarding an intern, sitting next to them, and guiding their decisions in real time.

The problem is that hard blocks get routed around. When Lovable first tried surfacing security bugs with a button for AI to fix them, very few users clicked it. Research revealed two reasons: users feared breaking something that already worked, and security felt too complicated and unfamiliar. This gap between democratized development and democratized security is the core tension Lovable is trying to solve.

How Lovable Is Shifting to Adaptive Security?

Rather than asking non-technical users to understand security, Lovable pushed responsibility onto the platform itself. In June 2026, the company shipped an auto-fix toggle in settings that silently scans every application and builds a security model, functionally a threat model, behind the scenes. The platform now fixes obvious issues automatically and reserves human interaction for questions only the builder can answer, such as whether a database table should be private or public.

"Ideally, there should be no security tab whatsoever in the app," Andriushchenko stated.

Igor Andriushchenko, Head of Security and CISO at Lovable

This approach is secure by design applied to an audience that will never read a secure coding guide. It is only possible because Lovable owns the entire loop from generation to deployment to runtime. Most vendors cannot make that claim, which is why platform providers have systemic leverage that individual security teams do not.

Steps to Building Security for Citizen Developers

• Build for scale you haven't reached yet: Plan security infrastructure for 10 to 15 times your current size, not last year's headcount, because threat models change as you grow and attract different adversaries.
• Anchor guardrails in business risk, not tool defaults: Derive hard boundaries from your actual risk model rather than vendor policy sets, distinguishing between soft guardrails that adapt and hard blocks that should never be crossed.
• Shift security responsibility to the platform: Automatically fix common issues silently and reserve human decisions for questions only the builder can answer, reducing cognitive load on non-technical users.
• Measure control efficiency layer by layer: Use governance, risk, and compliance (GRC) engineering to track coverage of each security layer, moving from "good enough" to near-complete coverage because AI-powered attackers will find gaps quickly.

What Changes When Attackers Use AI?

Andriushchenko's perspective on AI-powered attackers reshapes how to think about defense in depth. Historically, layered controls worked on a "good enough" standard. Each layer had gaps, but the aggregate slowed attackers down long enough to detect and eject them. That model breaks when someone with no offensive security background can point a capable AI model at a target and let it work automatically.

"Hacking at the cost of electricity" is how Andriushchenko described the new threat model. A relentless AI attacker will find the gap in layer one, then layer two, and do it fast. This means each layer now needs measured, near-complete coverage rather than good enough coverage. If your organization has multi-factor authentication (MFA) and endpoint detection and response (EDR), they need to be everywhere, not on most employees and not on that one contractor group.

GRC engineering becomes the discipline for proving controls actually work in near real time rather than generating compliance reports. Build the evaluation, get coverage from 80 percent to 85 percent to 90 percent, and keep going. This reframes compliance not as a checkbox but as a continuous measurement of whether your security actually works against modern threats.

Who Bears Responsibility for Citizen-Built Software?

When a citizen developer ships an app that touches personally identifiable information (PII) or protected health information (PHI), they have produced software and put it into the world, even though nobody would call them a vendor. Regulation is coming for this category. The EU AI Act, NIS2 directive, and Cyber Resilience Act (CRA) are landing on citizen developers who never considered themselves software manufacturers.

Andriushchenko's view is that the platform's job is to handle the compliance burden so the builder does not have to. This is not just a security problem; it is a regulatory one. As Lovable and similar platforms scale, they are becoming the de facto vendors for software that touches sensitive data, even when the person building it has no vendor experience.

The shift from hard rules to adaptive guardrails, from user-facing security tabs to silent auto-fixes, and from individual control coverage to layer-by-layer efficiency represents a fundamental rethinking of how security works when development is democratized. It is a model that other AI-native platforms will likely follow as they scale and encounter the same gap between what non-technical users can understand and what security actually requires.