loading
loading
Every workspace collects projects nobody touches anymore. A prototype from a hackathon. An internal tool built by someone who left in the spring. A landing page for a campaign that ended months ago. Many of them are still published, still connected to data, and mostly forgotten. This happens across all AI tools and is commonly known as "app sprawl". Forgotten doesn't mean gone. This Halloween, we're calling these lingering projects "undead apps", and we built a free game in Lovable for you to find. The game uses fictional projects; playing does not access or delete your real projects. Actual abandoned project clean-up is configured separately on the Enterprise plan. Where to find your abandoned projects Abandoned project clean-up is available on our Enterprise plan. Workspace admins and owners set it up in Workspace settings → Security → Privacy & security → Abandoned projects. It works in two steps: - Lovable marks a project as abandoned after a period with no activity. The default is 60 days. Published and unpublished projects are both covered. - If you turn on auto-delete, Lovable deletes abandoned projects after a grace period you choose: 7, 14, or 30 days. Auto-delete is off by default. Activity equates to use. This includes someone editing the project or chatting with it in the editor, a visitor to the published app (bot traffic excluded), or a call to the project's backend functions. Opening or previewing a project doesn't count, and publishing on its own doesn't reset the clock. You get warned before anything is deleted Deleting someone's work is a big step, so the feature is built to be careful. - Owners and members with edit access get a warning email and an in-project banner 5 days and 1 day before the deletion date. - Anyone with access can stop the deletion by editing the project, sending it a message, or clicking Keep it in the banner or email. - Deleted projects stay recoverable for 60 days. Admins restore them from Workspace settings → Workspace → Recently deleted projects. - When a project is deleted, its published app goes offline and its backend is paused. After 60 days, Lovable permanently deletes the project, its version history, and its chat. One thing to know: when a project is deleted, its lovable.app address is freed up. If someone else takes it, the project can't be restored to that address. The security risks of abandoned projects An app can keep running long after people stop using it. Its pages may still be accessible, its credentials may still work, and its database may still contain customer information. Without someone maintaining it, those risks can go unnoticed. - Old logins and credentials can still grant access: A demo built for a customer meeting may still accept sign-ins. An API key created for a quick experiment may still connect to a company system. Until those connections are disabled or the credentials are revoked, they can remain usable. - Known vulnerabilities can go unfixed: A signup form built for an event may rely on a software library that later needs a security update. If nobody maintains the app, that update may never happen. The app stays online with a weakness that has a fix. - Personal information can remain after its purpose has ended: Last year's waitlist may still contain names, email addresses, and form responses. Keeping the app running can also mean keeping information the business no longer needs. Someone needs to decide what to retain and delete what is no longer required. - Ownership can disappear while the app stays live: The person who built an internal tracker may change teams or leave the company. Without a handoff, nobody is clearly responsible for reviewing access, fixing findings, or deciding when to retire it. Turn it on in settings If you're an Enterprise admin or owner: - Go to Workspace settings → Security → Privacy & security. - Open Abandoned projects. - Set when projects are marked abandoned. The default is 60 days. - Turn on auto-delete and pick a grace period of 7, 14, or 30 days. Something spooky is hiding inside Lovable this Halloween. Log in and see if you can find it. Admins can configure real abandoned project clean-up separately in the settings above.
document fetched 2026-10-28 02:54