AI App Sprawl: How to Find and Retire the Apps Your Team Forgot

AI app sprawl is the pile of apps your team built with tools like Lovable, used for a few weeks, and then forgot, while they stay online and connected to real data with nobody responsible for them. The fix is a short inventory, a keep-or-retire decision for each app, and a proper shutdown for the rest.

On October 27, Lovable described the problem in a post about "undead apps": hackathon prototypes, tools built by people who have since left, and campaign pages that are still published and still connected to data. Lovable says this happens across all AI tools.

What is AI app sprawl?

AI app sprawl is what happens when building software gets cheap enough that nobody tracks what gets built. A sales manager makes a quote calculator in an afternoon. Someone in operations turns a spreadsheet into a tracker. Each solved a real problem. Few have a named owner, and almost none have an end date.

The apps themselves are rarely the danger. What they connect to is: a database of customer names, an API key (a password that lets one system talk to another) for your CRM, or a login that still works.

Why is AI app sprawl a security risk?

A forgotten app keeps whatever access it had on the day people stopped using it. Lovable's post lists four risks that apply to any AI app builder:

• Old logins and keys: a demo built for a customer meeting may still accept sign-ins, and a test API key may still reach a company system.
• Unpatched code: when a library the app depends on gets a security fix, nobody may apply it.
• Personal data past its purpose: last year's waitlist still holds names and email addresses.
• No owner: when the builder changes jobs, nobody reviews access or decides when to shut the app down.

The third risk has a legal edge. The FTC's guide to protecting personal information tells businesses to keep personal information only as long as they need it and then dispose of it properly. A forgotten waitlist app does the opposite by default.

How do you find every app your team has built?

To measure your AI app sprawl, start with the accounts, not with people's memories. Ask everyone who has used an AI app builder (Lovable, Bolt, Replit, v0 or similar) to share their workspace, then build a one-page register with a row for each app:

1. The app's name and published address.
2. Who built it, and who owns it now.
3. What data it stores, and whether any of it is personal.
4. What it connects to: CRM, email, payments, API keys.
5. When it was last really used, and by whom.

Also check for apps on personal plans signed up with a work email. Builder subscriptions on a company card are a good clue.

Which apps should you keep, and which should you retire?

Sorting your AI app sprawl takes three labels:

• Keep and harden: people use it weekly and it touches real data. It needs a named owner, a security review and a plan for updates. Our vibe coding security checklist covers what to check.
• Keep, but make it private: useful now and then, and low risk. Put it behind your company sign-in.
• Retire: nobody has used it in two months, or nobody can explain what it's for.

Sixty days is a sensible line, and it's the default Lovable chose. By default, its Enterprise plan marks a project abandoned after 60 days without activity, counting edits, real visitors (bot traffic excluded) and calls to the app's backend. Opening or previewing a project doesn't count.

How do you retire an AI-built app safely?

Shut it down in five steps, in this order:

1. Export what you must keep. Ask whoever handles your records whether any data has to be retained, and export only that.
2. Delete the personal data you don't need. Don't leave a copy in a download folder.
3. Revoke keys and connections. Delete or rotate every API key the app used, and disconnect it from your CRM, email and payment accounts. Deleting the app doesn't revoke a key that lives in another company's system.
4. Unpublish, then delete. Take the app offline first and wait a week to see whether anyone asks for it.
5. Fix the links. Update QR codes, email signatures and old pages that point to it.

When Lovable deletes a project, its lovable.app address is freed, and if someone else takes it, the project can't be restored to that address. A link you forgot could then send customers to a stranger's app.

Frequently asked questions

Does Lovable delete abandoned apps automatically?

Only on the Enterprise plan, and only if an admin turns auto-delete on, since it's off by default. Admins and owners pick a grace period of 7, 14 or 30 days, owners and editors get warnings 5 days and 1 day before, and deleted projects can be restored for 60 days.

Is AI app sprawl only a Lovable problem?

No. Any builder that lets staff publish a working app in an afternoon can produce AI app sprawl.

How often should we review the app register?

Every quarter suits most small teams, plus a check whenever someone who builds apps leaves.

What if an app we want to keep was built by someone who left?

Treat it as new software. Have someone work out what it does, check what data it can reach, and move it into an account the company controls.

How do you keep AI app sprawl from coming back?

Don't ban AI app builders; they save real time. Set two rules instead: every published app goes on the register, and every app has a named owner. Once AI app sprawl is on one page, the decisions are usually quick. If an app on the list turns out to be business-critical, our Prototype to Production team can help it hold up, and a free audit is a good first step.