Vibe-Coded Apps in 2026: When an AI-Built App Can Run Your Business

Vibe coding means describing an app to an AI in plain language and accepting what it builds without reading the code. Andrej Karpathy named it on February 2, 2025, as a way of working where you "forget that the code even exists", and called it "not too bad for throwaway weekend projects".¹³ AI app builders such as Lovable, Bolt, Replit, v0 and Base44 turned that into a product: a chat on one side, a running app with a database and logins on the other. Simon Willison's test is the useful one for a business. If a person reviewed the AI's code, tested it thoroughly and can explain how it works, "that's not vibe coding, it's software development".¹⁴ The question this guide answers is which apps can stay on the first side of that line and what it takes to move the rest across.

• 10.3%of 1,645 Lovable apps scanned in 2025 had database access rules weak enough to expose data²
• 61.8%of workflows the best model completed when its generated apps were deployed and tested in a browser⁵
• 17.2%the best checkpoint score when agents had to keep extending their own code; none finished a problem⁶

Where an AI-built app is enough

The clearest official guidance comes from the UK's National Cyber Security Centre, which in June 2026 described a "vibe coding spectrum" on the principle that different code deserves different levels of oversight. For a proof of concept or an internal tool with limited risk, it says, "full vibe coding in these contexts can often be perfectly fine". For authentication on a public site, code that processes sensitive customer data, anything handling secret tokens or credentials, and anything where "the consequences of a security flaw would be significant", it tells teams to slide toward manual coding with AI assistance.¹

The builders' own contracts draw a similar line. Replit's shared-responsibility model gives the customer the job of "verifying correctness, security, and licensing of Agent output".¹⁵ Lovable's terms forbid using AI output "without appropriate review in high-risk or sensitive contexts (including medical, legal, financial, or safety-critical uses)".¹⁶ The marketing says build and run a business; the terms say the review is yours.

People who build software for a living use these tools more carefully than the demos suggest. In Retool's survey of 817 of its customers and builders, 51% had built production software their teams use and 35% had replaced at least one SaaS tool, mostly workflow automations and internal admin tools. Among those who had shipped, 72% used AI for discrete pieces of code inside larger projects, only 8% used AI code without changes, and 41% named security and compliance as a top blocker.¹⁷ In Stack Overflow's 2025 survey, 72% of developers said vibe coding is not part of their professional work.¹⁸ Its 2026 survey found developers use AI mostly to generate code in familiar areas (67%) and to debug (61%), and only 20% use it to deploy, operate or troubleshoot production systems.¹⁹

The fear that companies would replace their software vendors with AI-built apps moved markets this year. The S&P 500 software and services index lost more than 26% from late January to its April low in what traders called the "SaaSpocalypse", then by October 6 stood at its highest level since November 2025, with one strategist calling AI "more of an enabler" for these companies.²⁰ The best-known replacement story is thinner than its retelling: Klarna's chief executive said "we did not replace SaaS with an LLM", and described an internal stack built on a graph database and other tools.²¹

What the builders generate and how they charge

The code these tools write is ordinary modern web code. What ties an app to the builder is the hosted backend around it. Lovable's built-in backend is a managed Supabase Postgres database with authentication and storage, and its documentation warns that "moving the PostgreSQL database alone does not move authentication, storage, realtime, or Edge Functions".²² Bolt Cloud runs its backends on Supabase.²³ v0 deploys to Vercel.²⁴ Google moved its app building into AI Studio, which sets up Firestore and Firebase Authentication, and is sunsetting Firebase Studio, which stays accessible until March 22, 2027.²⁵

The seat price is rarely the bill. Bolt's own help pages tell users to "avoid clicking Attempt fix over and over", because each attempt uses tokens.⁸ Replit replaced a flat $0.25 per checkpoint with effort-based pricing in 2025, once its agent began running for up to 20 minutes at a time.²⁹ After Agent 3 launched in September 2025, one user told The Register: "In the last week alone it charged me $1K since the new agent dropped whereas before it was never more than $180-200 a month for the same effort."⁹ Lovable says its current chat pricing applies through October 31, 2026, and that its monthly Cloud and AI grants are "a temporary offering and subject to change".⁷

The vendors are now large companies. Lovable reached $500 million in annualized revenue in June 2026, says it hosts 60 million projects, and raised $400 million at a $13.3 billion valuation in August.³¹ Wix reported about $150 million of annual recurring revenue for Base44 as of May 2026.³² Use is less steady than revenue: Barclays analysts put Lovable's traffic down 40% from its peak by September 2025,³³ and Bolt's chief executive said consumer users churned too fast to build around, with enterprise customers about 25% of revenue.³⁴ Size lowers the risk that a platform disappears. It does not change who is responsible for the app.

What the security audits found

Apps on Supabase-backed builders talk to their database straight from the browser using a public key. That is safe only when row level security rules in the database decide which rows each user may read or change. Every large audit finds those rules missing or wrong. Matt Palmer's 2025 scan found 303 vulnerable endpoints across 170 of 1,645 Lovable projects, about 10.3%, with inadequate rules.² The CVE he filed, CVE-2025-48757, lists all versions as vulnerable and no fixed version, because the flaw sits in each generated app.³

Later studies count differently and agree on the pattern. Escape analyzed more than 5,600 publicly available vibe-coded apps and found more than 2,000 vulnerabilities, over 400 exposed secrets and 175 exposures of personal data, including medical records and bank account numbers.³⁵ Symbiotic Security, which sells scanning, scanned 1,072 such apps and found 431 critical issues and 172 sites where anyone could delete records without logging in.³⁶ An academic audit of 200 deployed apps built with Claude Code and Lovable found 91% with at least one vulnerability and 65.77% of the 1,186 flaws rated critical or high, concentrated in broken access control, injection and authentication.⁴ In September 2026 UpGuard told TechCrunch it had found about 16,000 databases hosted on Supabase exposing personal data. It did not show those apps were AI-built, and Supabase answered that its projects are "secure by default" and that security is shared with customers.³⁷

Newer models have not closed the gap. Veracode's spring 2026 update, covering more than 150 models, found code that compiles more than 95% of the time and a security pass rate stuck at about 55%, with Java at 29%.⁴⁴ On BaxBench, even the best model wrote correct backends 62% of the time, and about half of the correct programs could be exploited.⁴⁵ On SusVibes, an agent built on Claude 4 Sonnet produced functionally correct solutions to 57% of real feature requests and secure ones to 11.8%.⁴⁶ Models also invent software packages: 19.7% of 2.23 million suggested packages did not exist, and 43% of those invented names came back on every repeat of the prompt, which lets an attacker publish a malicious package under the name.⁴⁷

The builders have added scanners. Lovable runs a basic scan of database configuration and access rules each time an app is published, and enterprise admins can schedule recurring deep scans.⁴⁸ Replit says its publishing checks "complement, rather than replace" a full security scan.⁴⁹ No scanner knows the business rules, such as which customer may see which invoice, so the rules still need a person who knows the business to write them down and test them.

Why the second feature is harder than the first

Building a first version is the part these tools do best. Vibe Code Bench, from Vals AI and MIT, gives models 100 app specifications, deploys what they build and tests the result with a browser agent. The best model, GPT-5.3-Codex, completed 61.8% of workflows and Claude Opus 4.6 57.6%. Of the failures, 46.7% were missing features, 20.4% were sign-up or login that did not work, and 14.8% were access policies blocking the user.⁵

Businesses live on the second, tenth and fiftieth change, and that is where agents struggle. On FeatureBench, Claude 4.5 Opus resolved 74.4% of SWE-bench tasks and only 11.0% of feature-development tasks.⁵⁰ SlopCodeBench makes agents keep extending their own code as the specification changes; across 11 models no agent solved any problem end to end, the best checkpoint score was 17.2%, and structural erosion rose in 80% of runs. Prompting for clean code gave a cleaner start, and the decline then resumed at the same rate.⁶ A study of projects that adopted Cursor found a 281% rise in lines added in the first month that faded within two months, while static-analysis warnings rose 30% and code complexity 41%.⁵¹ CodeRabbit, which sells code review, counted 10.83 issues per AI-authored pull request against 6.45 for human-only ones, with security issues up to 2.74 times higher.⁵²

The famous success statistic comes with a qualifier. Y Combinator said a quarter of its Winter 2025 batch had 95% of their code written by AI, and its managing partner added: "Every one of these people is highly technical, completely capable of building their own products from scratch."⁵³ The founders getting good results from AI-written code are the ones who can read it.

What a demo never tests

Several properties of a production system are invisible when the owner tries the app. Access rules look right because the owner can see everything. One environment looks fine until an agent changes live data, which is how the SaaStr database was lost; Replit's answer was to separate development and production databases.³⁹ Usage-billed hosting costs nothing at ten users. The artists' network Cara, which was not AI-built, received a $96,280 Vercel bill for one week after growing from 40,000 to 650,000 users.⁵⁴ No benchmark found in our research measures how generated apps handle load, backups or monitoring, which means nobody is grading those properties for you.

Outside rules apply to the app whoever wrote it. Card payment pages fall under PCI DSS v4.0.1, whose payment-page script requirements 6.4.3 and 11.6.1 now reach merchants through a new eligibility check, and the PCI Council says the change does "not remove or diminish the underlying requirements".⁵⁵ Apple's guideline 5.1.2(i) requires an app to disclose and get permission before sharing personal data with third-party AI,⁵⁶ and in March 2026 Apple blocked App Store updates for the Replit and Vibecode apps, citing guideline 2.5.2 on code that changes an app after review.⁵⁷

A trade has formed around these gaps. 404 Media reported in September 2025 that "vibe coding cleanup specialist", a LinkedIn joke, had become a growing profession, with freelancers and whole firms fixing apps built by non-engineers.⁵⁸ We found no independent study of how many AI-built prototypes are kept, hardened or rebuilt, or what that costs. The cost depends on how much of the data model and access logic must be redone, whether the app has to leave the builder's backend, and how many tests must be written from nothing.

Who owns the app, the data and the exit

Each builder tells customers they own what they build, and each qualifies it. Lovable says "as between us, you own your Customer Data, including the applications".¹⁶ StackBlitz, which runs Bolt, assigns its rights in AI output "if any" and notes that the service "may generate the same or similar output for other users".¹⁰ Base44 grants ownership "to the extent such rights exist under applicable law".¹¹ The qualifiers matter because the US Copyright Office says copyright can cover human creative arrangements or modifications of AI output, "but not the mere provision of prompts",¹² and the Supreme Court declined on March 2, 2026 to hear the case on AI authorship.⁵⁹ An app built from prompts alone may have little protection; the human design and changes recorded in a repository are what a business can defend.

The licenses also run toward the vendor. Lovable takes "a worldwide, perpetual, royalty-free license" to use customer data for its business purposes.¹⁶ Base44 takes an "irrevocable, non-exclusive, worldwide, royalty-free, perpetual" license over customer data.¹¹ Vercel may train its models on content from Hobby and trial Pro accounts.⁶⁰ Where an app collects personal data, the business is the controller under GDPR and "shall use only processors providing sufficient guarantees" under a written contract.⁶¹ Lovable's terms say it does not guarantee processing "in any particular country or region", and a Lovable Cloud project's region "is locked and cannot be changed" once chosen.¹⁶⁶² India's DPDP Rules, notified on November 14, 2025 with an eighteen-month phase-in, put penalties of up to ₹250 crore on a Data Fiduciary that fails to keep reasonable security safeguards, whoever wrote the code.⁶³

Platforms change. Replit "reserves the right to modify, deprecate, or remove features of the Service at any time and for any reason", without refunds.⁶⁴ Vercel may remove content "for no reason at all", with extra protections for European users.⁶⁰ Firebase Studio will have run for less than two years when it closes.²⁵ Four questions settle the exit: can the code, the database and the login system all be exported; does the app run somewhere else; is it on a domain the business owns; and can the monthly bill be predicted. An app that fails them is a good prototype and a weak foundation.

How to take a prototype to production

1. 1Place the app on the spectrum List what it touches: logins, personal data, payments, secrets, outside users. If none, keep it on the builder with an owner and a backup. If any, plan the work below.¹
2. 2Move the code where you control it Sync it to a repository the business owns, record the human design decisions, and confirm the database and login system can be exported too.²²
3. 3Rewrite access rules on the server Write down who may read and change each kind of record, enforce it in the database or API, and test it with two ordinary accounts trying to read each other's data.²
4. 4Separate environments and test a restore Give development and production their own data, keep the agent away from live data, and restore a backup once before launch.³⁹
5. 5Take secrets out of the browser Move API keys and paid-service calls to server functions, and check every package the AI added actually exists and is the one intended.⁴⁰⁴⁷
6. 6Test the flows the business depends on Write automated tests for sign-up, login, payment and the core records before adding features, so each change shows what it broke.⁵
7. 7Watch errors and cost Add error tracking, uptime checks and spending alerts on hosting and AI usage before marketing brings traffic.⁵⁴
8. 8Sign the paperwork Put a data processing agreement in place, choose the data region deliberately, and check the plan's training default before any customer data goes in.⁶¹⁶²

AI app builders have changed what a prototype is worth. A working app that a founder or product manager built in a week is a better specification than most requirement documents, and it settles arguments about what to build before money is spent. The same evidence shows where it stops: the agent does not decide who may see which record, keep live data away from its own mistakes, or keep a growing codebase coherent. Those decisions belong to whoever answers for the app when something goes wrong.

This is how we approach AI-built apps in our custom software development work: start from the working prototype as the specification, move it into a repository and backend the client owns, rewrite access rules and secrets handling on the server, separate environments, and put tests, monitoring and cost alerts in place before real users arrive.