Is Lovable Project Downloader safe?
Lovable Project Downloader reads Lovable session JWT cookies and uses them to download project source files.
When you are on a Lovable project page, the extension reads Lovable session cookies, stores JWT-shaped tokens locally, and uses a token as a bearer credential. It sends that credential to Lovable API endpoints to fetch project source code and missing raw file assets for a local ZIP download.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Where it sends data
Destinations our analysis observed Lovable Project Downloader contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- api.lovable.dev
Lovable Project Downloader sends data to api.lovable.dev. No other extension we have analysed sends data here.
- lovable-api.com
Lovable Project Downloader sends data to lovable-api.com. No other extension we have analysed sends data here.