Lovable PromptsLovable Prompts

    Free Lovable Templates

    Four build kits, free and without a sign-up. Each one is a complete build prompt plus the Supabase schema it expects, with row-level security already written and queries that prove the policies deny what they should.

    The schema half is the point. Lovable generates the interface well and generates access control badly enough that insufficient row-level security in Lovable projects has its own CVE. A prompt alone will not fix that, so these ship the policies too.

    Updated

    Free Lovable templates hero: the guide title beside a kit-contents card, prompt.md is the full build prompt, schema.sql has tables and RLS that deny by default, verify.sql runs as a member and expects denials, not a repo or a theme, Lovable's own gallery has 207 remixable templates, policies counted at build time

    What a template is here, precisely

    A build prompt, a schema with policies, and verification queries. Three files you can read before you run anything.

    It is not a repository you clone and run, and not a theme. Lovable generates the app from the prompt; the SQL gives it a database that is safe to point at. We are explicit about that because the alternative is a page that promises a zip and delivers a prompt list.

    Every build prompt on these pages is free to copy and download. The schemas and their verification queries are previewed here and included in full with The Complete Lovable Bundle, because writing and actually testing row-level security is the part that took the work.

    SaaS App
    3 files

    SaaS Starter

    Multi-tenant workspaces, three roles, and a working invite flow, with the row-level security that makes tenancy enforced rather than cosmetic.

    Landing Page
    3 files

    Landing Page with Email Capture

    One offer, one action, an indexable copy body, and the insert-only policy that stops your email list being publicly downloadable.

    Backend Logic
    3 files

    Internal Admin Dashboard

    Role-gated metrics and an append-only event log, where the admin check lives in the database rather than in a hidden menu item.

    App Builder
    3 files

    Lightweight CRM

    Companies, contacts and an append-only note timeline for a founder doing their own sales, with shared team reads and owner-only writes.

    The Complete Lovable Bundle

    $199 once. Unlimited generation, every prompt, every kit, every future drop

    Every prompt, every Pro variant, all four build kits and every future drop, in one Notion workspace. One payment, never a subscription.

    Get the 151-Prompt Bundle

    What does “Lovable templates” mean on Lovable's own site?

    A gallery of remixable apps. Lovable's templates page, read 26 September 2026, is titled “Website and app templates Built with AI” and lists 207 of them as “Production-ready apps from the Lovable community”. Per the remix page, you can “browse the templates gallery without logging in”, and a remix “creates your own independent copy of a project”. That copy carries code, database structure (tables and schema, not records), chat history, if enabled, project files, if enabled, custom knowledge, if present. It does not carry database data, version history, secrets, custom domains, publish state, collaborators, service connections such as Git sync and connectors. Two limits worth knowing before you pick one: “Projects connected to external Supabase projects can only be remixed by people with edit access to the source project.” and, from the payments page, “Projects with payments cannot be remixed”.

    A Lovable gallery template against a build kit on this page, 26 September 2026
     Lovable gallery templateBuild kit here
    What you receiveA working app copied into your workspaceA prompt, a schema with policies, and verification queries
    DatabaseThe template's tables and schema, no recordsTables written for the prompt, RLS on every one, deny by default
    Proof the policies denyNone shipped; run the security scansA verify.sql per kit, run as the wrong user
    Where you editIn the remixed project's chatIn the prompt before the first message
    CostRemix on any plan; building on it uses creditsFree to read and copy; full files with the bundle
    CannotRemix a project with payments or an external Supabase project you cannot editRun without Lovable; the kit is an instruction, not code

    The two are not rivals. Remix a gallery template when its screens are close to yours; paste a kit's schema when the data and who-can-read-what is the part you do not want generated. Doing both is the order in the FAQ below.

    What is in each kit, counted from the files?

    The numbers are read from the kit files at build time, so they cannot drift from what you download. Across the four: 30 policies on 10 tables.

    The four kits: tables, policies, verification statements, and the trap each one was written around
     TablesPoliciesChecksThe trap it handles
    SaaS Starter4126A recursive policy on the membership table, and a member promoting themselves to owner
    Landing Page with Email Capture117A public form that must accept writes without exposing reads
    Internal Admin Dashboard257An aggregate function that leaks the whole event log if made security definer
    Lightweight CRM3127An update policy missing its with check clause, so a record can be reassigned

    The Lovable and Supabase guide has the three shapes of RLS failure these traps belong to, and the security guide shows what Lovable's own scans do and do not prove about them.

    Templates or prompts?

    Use a template when you are starting something and want the database decided for you, including who can read what. Use a prompt when you know the shape of what you are building and only need the instruction.

    The prompt library has 151 prompts across 11 categories, each tied to a growth channel. The generator writes one for an idea that does not match an existing pattern.

    Why row-level security is the hard part

    Every one of these kits ships policies that deny by default, and verification queries you run as an ordinary user rather than as the service role. That distinction matters more than anything else here: the service role bypasses every policy, so testing with it makes a broken schema look correct.

    The specific traps the four kits handle are a recursive policy on a membership table, a public form that must accept writes without exposing reads, an aggregate function that quietly leaks a whole event log if it is made security definer, and an update policy missing its with check clause so a record can be reassigned. Each is called out on the relevant page.

    Frequently asked

    What is a Lovable template?↓
    On lovable.dev/templates, read 26 September 2026, a template is a production-ready app from the Lovable community that you remix into your own workspace; the gallery lists 207 and can be browsed without logging in. On this page a template is a build kit: a prompt, a Supabase schema with row-level security, and verification queries. The first gives you an app to edit; the second gives Lovable an instruction and a database that is safe to point at.
    Are Lovable templates free?↓
    Lovable's gallery templates are remixable on any plan per the docs; the remix carries code and schema, not data, secrets or the publish state. The four kits here are free to read and the prompts free to download without a sign-up; the full schema and verification files ship with the bundle.
    What does a remix copy, and what does it not?↓
    Per the remix page: code, database structure (tables and schema, not records), chat history and project files if enabled, and custom knowledge. Not copied: database data, version history, secrets, custom domains, publish state, collaborators and service connections such as Git sync and connectors. Projects with payments cannot be remixed, per the payments page.
    Why does every kit ship verification queries?↓
    Because a policy that exists is not a policy that denies. Lovable's security scans confirm row-level security is present on a table; only a query run as the wrong user proves the policy rejects that user. The verification files run as a member, as an admin, or as an anonymous visitor and expect denials where the policy should deny.
    Can I use a kit on a remixed Lovable template?↓
    Yes, with one order: remix first, then paste the kit's schema as a migration, then run the verification queries before building features on top. A remix brings the template's own tables, so read the kit's schema against them for name clashes before running it.
    Which kit should I start with?↓
    The one whose trap matches your app. Multi-tenant with invites: SaaS starter. A public form that must accept writes without exposing reads: landing page. Roles in their own table with an audit log: admin dashboard. Records that must not be reassigned by their owner: CRM. The table on this page lists the trap each kit was written around.

    Sources

    All read on 26 September 2026. Quotes in src/data/lovableTemplates.ts; kit counts computed from src/data/templates.ts.

    What changed on 26 September 2026: the gallery and remix sections, the per-kit counts, the FAQ and the hero were added; the kits themselves are unchanged.

    Related reading