Auto-delete forgotten projects before they become a security risk

Enterprise admins and owners can turn on auto-delete, which is off by default, in Workspace settings → Security → Privacy & security → Abandoned projects. Lovable then marks a project abandoned after 60 days without activity (a default you can change), sends warning emails 5 days and 1 day ahead, and deletes it after the 7, 14 or 30-day grace period you pick.

Lovable has a setting that finds projects nobody uses anymore and, if you choose, deletes them. Many are still published and still connected to data.

The clean-up is available on the Enterprise plan. Workspace admins and owners set it up like this:

1. Go to Workspace settings → Security → Privacy & security. 2. Open Abandoned projects. 3. Set when projects are marked abandoned. The default is 60 days. 4. Turn on auto-delete and pick a grace period of 7, 14 or 30 days.

Auto-delete is off by default, and both published and unpublished projects are covered.

Opening or previewing a project doesn't count. Publishing on its own doesn't either.

Deletion is built with warnings. Owners and members with edit access get a warning email and an in-project banner 5 days and 1 day before the deletion date. Anyone with access can stop the deletion by editing the project, sending it a message, or clicking Keep it in the banner or email. A deleted project's published app goes offline and its backend is paused. Deleted projects stay recoverable for 60 days, and admins restore them from Workspace settings → Workspace → Recently deleted projects.

After 60 days, Lovable permanently deletes the project, its version history and its chat.

Lovable's post lays out why this matters. Old logins and credentials can still grant access. Known vulnerabilities can go unfixed when nobody maintains the app. A past waitlist can keep names and email addresses after its purpose has ended. And ownership can disappear when the builder changes teams or leaves while the app stays live.

Lovable also built a free Halloween game for finding undead apps. It uses fictional projects, so playing does not access or delete your real ones. Real clean-up is configured separately on the Enterprise plan.