Episode 6 · Resources
Vibe Coding Explained: How Lovable, Replit and Claude Code Actually Work
Everything from the video in one place: what an app is actually made of, what each vibe coding tool is built on under the hood, where these apps break, and the signs you need engineers. Plus the free checklist: 10 questions to ask before real users touch your app.
Type one sentence, get an app
That's the promise of vibe coding. The name comes from Andrej Karpathy, a founding member of OpenAI, who wrote in February 2025 about a new kind of coding where you "fully give in to the vibes, embrace exponentials, and forget that the code even exists." By the end of that year Collins Dictionary had made "vibe coding" its word of the year. The money followed: Lovable is valued at $13.3 billion, Replit at $9 billion, and Anthropic said Claude Code alone was bringing in more than $2.5 billion a year by February 2026.
What an app is made of
The easiest way to picture an app is a restaurant. Every vibe coding tool is a different way of putting the same restaurant up for you.
Frontend
Everything a customer sees and touches: the screens, the buttons, the forms. It runs in the customer's own browser, on their phone or laptop.
Backend
Where the real work happens, out of sight: checking an order, charging a card, sending a confirmation email. It runs on a computer somewhere else.
Database
Every customer, every order, every booking, stored on shelves so the kitchen can find it again tomorrow.
Auth
Authentication checks who you are when you log in. The rules about what each person can reach (your own orders, not someone else's) are the locks on the pantry shelves.
Hosting
A computer that's switched on all day, every day, connected to the internet. Almost nobody owns it: you rent it from a company like Amazon Web Services, Google Cloud, Cloudflare or Vercel.
Domain
The name on the sign out front. You rent that too, every year, from a registrar.
What the AI is actually doing
Underneath every one of these tools is a large language model: Claude from Anthropic, GPT from OpenAI or Gemini from Google. These models learned by reading an enormous amount of text, a lot of it code, and they write an app the way they write an email: one likely line at a time. That's why it feels like magic, and also why it can be confidently wrong. Code that looks finished and code that's actually safe are not the same thing.
The model itself only writes text. The files, the preview, the database and the hosting all come from the company wrapped around the model. That wrapper is what you're paying for.
What each tool is built on
Different chat boxes, different models, but underneath, the same handful of building blocks. Prices as of October 2026.
Claude, a template, a cloud preview, Supabase and Cloudflare in one chat box
- Your message is wrapped in Lovable's own hidden instructions plus a starter template, so every project starts from the same setup.
- The model: Lovable picks it and you can't change it; its changelog keeps naming Anthropic's Claude models. A main agent hands pieces of the work to smaller helper agents.
- The code: a React web app. New projects since May 2026 use TanStack Start, which builds pages on the server first.
- The preview: your app runs on a temporary computer in the cloud while you chat.
- Kitchen and pantry: Lovable Cloud gives every app a database, logins, file storage and edge functions, "built on Supabase's open-source foundation" (a Postgres database with logins and storage around it). You can connect your own Supabase account instead.
- Hosting: Publish puts a snapshot on Cloudflare's network at yourapp.lovable.app. A custom domain needs a paid plan.
- Taking it with you: code syncs to GitHub; your database data doesn't come along automatically.
- Price: Pro is $25 a month for 100 credits, and every message spends some.
Your app runs inside your own browser tab
- The preview: WebContainers, a tiny operating system that runs a real server inside the browser, which is why the preview starts so fast.
- The model: it started out on Anthropic's Claude models. Today you pick a standard or a max agent and Bolt chooses the models behind the scenes. Its original 2024 instructions began "You are Bolt, an expert AI assistant and exceptional senior software developer."
- Hosting and database: Bolt Cloud was built with Netlify for hosting and Supabase for the database.
Built by a hosting company, published to its hosting
- The code: Next.js, Vercel's own React framework.
- The preview: a small virtual machine in Vercel's cloud.
- Hosting: one click to Vercel. Database: one click adds Supabase or another provider.
Not a finished restaurant: a whole rented workshop
- The workspace: every project runs in its own cloud workspace on Google Cloud, with a code editor, a terminal, file storage and secrets (where passwords and keys live, out of the code).
- Replit Agent 4 makes a plan, builds it, then tests it like a person: it opens your app in a real browser, clicks around and fixes what breaks. Web apps, mobile apps, dashboards, even slides.
- Two databases: development for building and testing, production for your real customers' data. The agent can't touch production.
- Publishing: Autoscale adds computers when you're busy and shrinks to nothing when you're quiet; a Reserved VM is one always-on computer at a fixed price. Checkpoints let you roll back with one click.
- Price: based on effort (a small fix costs a little, a big build more). Plans start at $20 a month.
The other kind: an AI engineer on your own codebase
- It works on your own computer, in your real project folder. You ask for a change in plain English; it reads the code, edits the files, runs the commands and checks its work.
- No built-in hosting or database: you choose them (Amazon, Google, Vercel, whatever fits). More setup on day one, more control after it, and an engineer can work alongside it at any point.
- By February 2026 it was behind about 4% of all public code changes on GitHub, and in Stack Overflow's 2026 developer survey it was the most-used coding agent.
- Price: $20 a month on Anthropic's Pro plan, more for heavy use.
Where they shine
Speed to a first version
A clickable version of your idea in an afternoon instead of weeks, so a founder can test it before spending real money.
Showing instead of telling
A working demo in front of an investor or a first customer beats a slide deck every time.
Internal tools
A simple dashboard, a form your team fills in, a calculator only your staff uses. Small audience, low risk, real value.
Landing pages and simple websites
Where the job is mostly the dining room and the kitchen is light.
Where they break
Engineer Addy Osmani put it simply: AI gets you 80% of the way to a working product, and the last 20% takes patience, real learning or hiring engineers. That last 20% is where your customers' data and money live.
170 of 1,645 Lovable apps were leaking data
In many Lovable apps, the app's own code in the customer's browser talked straight to the database, so the access rules were the only protection, and in many apps they were missing or set up wrong. One scan found 170 of 1,645 apps leaking names, emails, financial details and keys. Lovable now scans every app when you publish, but its own docs say a scan can't guarantee complete security.
An agent deleted a production database during a code freeze
SaaStr founder Jason Lemkin was testing Replit's agent when it deleted his production database (records on more than 1,200 executives and nearly 1,200 companies), then said it had "panicked." The data was recovered, Replit's CEO called it unacceptable, and that's why the agent can no longer touch production.
Moltbook left a database key in its own website code
Its founder said he "didn't write a single line of code." Security researchers at Wiz found the key exposed about 1.5 million API keys and some 35,000 emails.
45% of AI-written code had well-known security flaws
Veracode tested more than 100 AI models; its 2026 follow-up found the code compiles, but only about 56% passes the security checks. In Stack Overflow's survey, more developers distrust AI code than trust it, and the top complaint was answers that are "almost right, but not quite."
There are quieter costs too: fix loops, where the AI says a bug is fixed and it isn't and every new try spends credits; logins and databases tied to one platform; and bills that grow with every message.
When a vibe-coded app needs engineers: five signs
It holds people's personal information, or takes payments
The moment there's something valuable in the pantry, the locks have to be checked by someone who knows locks.
It needs to connect to the systems you already run
Your CRM, your accounting software, your scheduling system, your industry's own software. That's where most of the real value is, and where app builders run out of road.
The rules are complicated
Pricing with exceptions, permissions by role, approvals: anything where "almost right" costs you money.
Compliance
Health records, financial data or large customers mean you'll be asked how your app is secured and backed up, and you'll need real answers.
It has to last
Real users, real growth and changes for years mean code you own, hosting you control and backups you've actually tested.
The smart path isn't choosing between AI and engineers. It's both, in order: prototype with a vibe coding tool to prove the idea fast and cheap, then have engineers review it, lock the pantry, connect your real systems and move it somewhere you own, with AI in the loop the whole way and engineers steering.
10 questions before real users touch your app
Built something with Lovable, Bolt, v0, Replit or Claude Code? Go through these before you share the link with real customers. Print it, or keep this page open.
Can one user see another user's data?
Make two test accounts. Signed in as one, try to open the other's records, orders or profile, including by changing the ID in the address bar.
Is every table locked?
If your app uses Supabase (Lovable, Bolt and v0 apps often do), check that row-level security is on for every table, with a rule for who can read and write each one. A table without it is an open shelf.
Are any secret keys in the code the browser downloads?
A public "anon" or "publishable" key is meant to be there. Secret or service-role keys, payment keys and other providers' API keys belong on the server, in the platform's secrets. Run your platform's security scan, and have an engineer look at what a scan misses.
Can the AI change your live data?
Build and test on a development copy, with real customers' data in a separate production database the agent can't touch.
Do you have a backup, and have you restored one?
Find out where backups live and how often they run, then try one restore before you need it.
Do you own the code?
Sync it to a GitHub account you control, so it can move if you outgrow the platform.
Can you take your data with you?
Check how to export the database and your users' logins. Exporting the code usually doesn't bring the data along.
Do payments go through a payment provider?
Card details are handled by a provider such as Stripe, not stored in your own database. Test a refund and a failed payment.
What happens when it gets busy, and what will it cost?
Know your plan's limits, how the bill grows with users and messages, and set a spending alert.
When something breaks, who finds out and who fixes it?
Error alerts that reach a person, a way for users to report problems, and someone who can read the code.
Sources
Where the facts in the episode come from.
Built a prototype? Make it real.
That's what Benmore does: engineers who review what you've built, lock it down, connect it to the systems you already run and move it somewhere you own, with AI writing a lot of the code and engineers owning the decisions.
Talk to Benmore