Lovable, Bolt, Cursor: when vibe coding is enough and when it isn't

With tools like Lovable, Bolt or Cursor, you describe what you want in plain language and get a running app within minutes. It's called vibe coding, and it's impressive. I use AI tools every day myself, a large part of my code is now written with their help.

Still, I keep seeing the same pattern: the first version is there in hours, but the road to a product that real users can rely on then takes months or ends altogether. This article is about when vibe coding is the right choice and when you need more.

In short

• Vibe coding is ideal for prototypes, internal tools and testing ideas quickly.
• It hits its limits with payments, personal data, multiple roles or integrations.
• Typical problems are missing UX thinking, security gaps, hard-to-maintain code and platform lock-in.
• The middle path: AI speed combined with experienced product judgement.

What vibe coding does really well

• Making ideas visible: instead of describing an idea, you show it. For conversations with customers, investors or your own team, that's gold.
• Prototypes for user tests: a half-working version is often enough to learn whether people even have the problem.
• Internal tools: a small app for three colleagues, without sensitive data and without payments, is exactly what vibe coding is made for.
• Speed: what used to take a week is done in an afternoon.

For a simple prototype, vibe coding is therefore often exactly right. The question is what comes next.

Where it breaks

Complexity doesn't grow linearly

The first 80 percent come fast. The last 20 percent, meaning edge cases, error handling, permissions and constraints, make up most of the work. That's exactly where many vibe coding projects start going in circles: one prompt fixes a bug and creates two new ones.

The models lack UX thinking

AI models copy patterns they have seen thousands of times, even when they make no sense for your product. The result looks professional at first glance and, at second glance, like every other AI app: interchangeable, full of standard components, without clear guidance for the user. The term AI slop has caught on for this.

A product that is meant to stand out needs decisions: what do we leave out? What does the user need to understand first? Where may it look different from everyone else? No model makes those decisions for you.

Security isn't the default

In spring 2025, a critical vulnerability in Lovable apps became public: many projects lacked access rules at database level, so outsiders could read user data, API keys and payment data (CVE-2025-48757, Matt Palmer). An analysis of 1,645 Lovable apps found openly readable data in 170 of them (Superblocks).

That's not an isolated case but a pattern. In a large study by Veracode, AI-generated code contained known security flaws in 45 percent of tests (Veracode, 2025). Which mistakes are typical is covered in Security flaws in AI-generated code.

Maintainability and handover

Code nobody understands, nobody can develop further. Many generated projects have no tests, no clear structure and no documentation. As long as only you work on it, nobody notices. As soon as a development team is supposed to take over, it often gets rebuilt.

Platform lock-in

Some tools make getting in easy and getting out hard. Check early: can you export the code, put it in your own repository and keep running it without the tool?

Checklist: is vibe coding enough for your project?

Vibe coding is probably enough if:

• you want to show an idea or test it with a few users,
• no personal or sensitive data is processed,
• no money changes hands,
• the result may be thrown away afterwards.

You need more if:

• real customers sign up and enter data,
• money flows, whether through subscriptions or one-off payments,
• there are several roles with different permissions,
• existing systems need to be connected,
• the product should grow and be developed further by a team.

The middle path: AI speed with product judgement

The alternative to vibe coding isn't giving up AI. The alternative is combining AI with experience. This is how I work with Framepass:

• I decide what gets built. Scope, UX and architecture come from me, backed by 18 years of product experience. That includes choosing the right tools from the start.
• The AI crew accelerates delivery. Research, code and tests happen much faster than they used to.
• Nothing ships unreviewed. Before launch the code is checked for the typical gaps, from access rules to payments.
• You own the code. Everything lives in your repository, with documentation, so your team can take over.

That way you get the speed of AI tools and still a product that is distinct and works with real users.

Frequently asked questions

What is vibe coding?

Vibe coding means having AI tools like Lovable, Bolt or Cursor generate software from a plain-language description instead of programming it yourself.

Can you build an app for real customers with Lovable?

For prototypes and simple applications, yes. As soon as payments, personal data, multiple roles or integrations come in, it needs experienced review and often a reworked architecture.

How secure are apps built with Lovable?

That depends on the implementation. In 2025, missing access rules were discovered in many Lovable apps (CVE-2025-48757). Row level security and server-side checks should therefore always be reviewed.

Can a vibe coding project be developed further professionally?

Often yes, sometimes a rebuild is cheaper. What matters is code quality, the data model and whether the code can be exported. A short review shows which path makes more sense.

Conclusion

Vibe coding is a great tool for getting started. Once things get more complex and have to really work, you need someone who makes the right decisions, picks the right tools and knows where AI typically gets it wrong. If you're at that point, let's talk.