Trust center

1. 1

   Go to your project's settings.

   This is where you manage project-level features and configurations.

2. 2

   Find the 'Publishing' section.

   The Trust center is a publishing feature, so its controls are located here.

3. 3

   Enable the 'Trust center' option.

   This turns on the feature, and Lovable will automatically generate the security page for your app.

4. 4

   If your app was published before the Trust center existed, publish your app again.

   This ensures Lovable can evaluate your current app and generate the initial security facts.

Please enable the Trust center for my project. I understand it will generate a public security page for my app at /.well-known/trust.html and /.well-known/trust.json, and I may need to republish my app if it was last published before this feature existed.

SBOM

A 'Software Bill of Materials' is a complete list of all the ready-made software parts (like open-source components) that your app is built from. It's like an ingredient list for your software.

HTTPS

This is a secure way for your web browser to connect to a website, making sure that no one can snoop on the information you send or receive.

Dependencies

These are the ready-made software components or libraries that your app uses to function, rather than building everything from scratch.

Deployment

This refers to a specific version of your app that has been put online and is currently running for users.

SOC 2 or ISO 27001

These are formal certifications that show a company meets certain security and privacy standards, usually requiring an independent audit. The Trust center is not these certifications.

• Do not expect the Trust center to be a formal compliance certification like SOC 2 or ISO 27001; it provides factual observations, not an audit.
• Do not try to edit the trust page or add your own claims, as its credibility comes from being unalterable by you or your app's code.
• Do not assume a missing check means a security alert; it simply means Lovable makes no claim about that specific item.
• Do not expect the Trust center for apps that are not published externally or are only published to workspace members, as it's designed for public-facing apps.
• Do not confuse your app's Trust center with Lovable's platform trust page (trust.lovable.dev) or the internal Security center; they serve different purposes and audiences.