v0

Lovable

Prompt to full-stack app, Supabase built in.

Bolt

In-browser full-stack app builder by StackBlitz.

Base44

Prompt-to-app builder for internal tools and MVPs.

Rork

AI-first mobile app builder using React Native.

Softgen

AI software architect for end-to-end web apps.

Databutton

AI-first builder for data apps and internal tools.

Auth Check Only in Client Code

The auth gate runs only in a client component (a useEffect redirect or conditional render), so an attacker can bypass it by calling the API route directly.

IDOR Vulnerability on REST Endpoint

A REST endpoint returns resources by id without checking the caller owns them, so any signed-in user can read another user's data by changing the id.

Missing Row Level Security on Supabase Table

A public Supabase table has RLS disabled or an overly permissive policy, so any signed-in user can read or modify every row regardless of ownership.

Secret API Key Exposed in Client Bundle

A sensitive key (Stripe secret, OpenAI, Supabase service role) has a NEXT_PUBLIC_ prefix, so it is inlined into the browser bundle for anyone to read.

v0 to Production: What Vercel's AI Misses

v0 generates beautiful UI with Tailwind and shadcn, but UI isn't an app. What v0 gets right, what it misses, and how to take its output to production.