CrowdStrike and Lovable announced a Falcon Shield integration on November 3, 2026. CrowdStrike says it uses Lovable workspace information and existing Security Center results to bring application exposure, security findings and access information into its SaaS security inventory. One detail deserves attention: its stated discovery scope includes privately published projects shared with external viewers, as well as public applications.

Conceptual illustration of application audiences and a scan-review notebook; not an actual product interface.
Conceptual illustration of application audiences and a scan-review notebook; not an actual product interface.

CrowdStrike’s November 3 integration announcement

Ask two questions about each application

For a review, write down the intended audience and the evidence about the current application separately. A project described as private can still have invited external viewers. CrowdStrike also names missing or outdated scans among the conditions the integration can surface. These are vendor-described capabilities; this article has not connected a workspace or verified discovery coverage.

Lovable’s security documentation distinguishes a Quick scan from a broader Deep scan. It says these tools cannot guarantee complete security and do not replace a thorough review. Treat a scan result as evidence with a scope and date, rather than as an answer to every audience or access question.

For a more detailed security-test record, the Arnica coverage worksheet separates the tested build and completed checks from components outside the run.

Lovable’s explanation of its security scans and their limits

Try a small review with fictional records

Imagine a team evaluating the integration with three invented training applications: Staff Planner, Partner Preview and Public Demo. The names and expected audiences below are a proposed exercise, not real customer findings or a description of a built-in testing feature. Use non-sensitive demonstration data and an evaluation authorized by the workspace owner.

  • Staff Planner: intended for the internal team. Record its project identifier, expected viewers and the reviewer responsible for confirming the audience.
  • Partner Preview: intended for two invited partners. Record those test identities explicitly; the word private alone would leave the requirement ambiguous.
  • Public Demo: intended for general viewing. Record which demonstration content is meant to be visible and who owns that decision.

For each record, add the source workspace, observation time, scan type and scan time, any unresolved finding, and the next review owner. Keep unknown fields marked unknown. These are suggested worksheet fields; they are not a claim that Falcon Shield supplies every field or updates it at a particular frequency.

Define what would count as useful evidence

Before an approved pilot, ask the suppliers how workspace connection, licensing, refresh timing and project coverage apply to your deployment. Write down the answer alongside the specific workspace being evaluated. An announcement does not establish your tenant’s configuration or commercial eligibility.

Compare the expected training records with what the review actually shows. If Partner Preview is absent, record that observation and investigate it with the responsible owner. If it appears, check whether the audience information answers the original question. Preserve the distinction between an observed record and a conclusion about the whole workspace. No hands-on scan, access check or remediation was performed for this article.

Check the review distinction