Bolt

Lovable

Prompt to full-stack app, Supabase built in.

v0

Vercel AI UI generator for React and Next.js.

Base44

Prompt-to-app builder for internal tools and MVPs.

Rork

AI-first mobile app builder using React Native.

Softgen

AI software architect for end-to-end web apps.

Databutton

AI-first builder for data apps and internal tools.

Auth Check Only in Client Code

The auth gate runs only in a client component (a useEffect redirect or conditional render), so an attacker can bypass it by calling the API route directly.

IDOR Vulnerability on REST Endpoint

A REST endpoint returns resources by id without checking the caller owns them, so any signed-in user can read another user's data by changing the id.

Missing Row Level Security on Supabase Table

A public Supabase table has RLS disabled or an overly permissive policy, so any signed-in user can read or modify every row regardless of ownership.

Secret API Key Exposed in Client Bundle

A sensitive key (Stripe secret, OpenAI, Supabase service role) has a NEXT_PUBLIC_ prefix, so it is inlined into the browser bundle for anyone to read.

Bolt.new Apps: 7 Production Issues and How to Fix Them

Bolt.new gets you to a working app in minutes, but its code has patterns that break in production. Seven specific issues, with code-level fixes.

Cursor vs Lovable vs Bolt: What Each Tool Gets Right (and What They All Skip)

An honest comparison of Cursor, Lovable, and Bolt: what each does well, the gaps all three leave, and how to close them before you ship.