The weary pilgrim tosses his last coin into the well, whispering his deepest desire to the dark waters. He hopes some hidden magic might make it real. The dream of the wishing well is as old as humanity. The genie in the bottle, the magic wand, the monkey’s paw. People have always wanted to speak their desires into existence. AI code generators like Lovable or V0 are just the latest way to meet this age-old desire.
Lovable has always been a toy. Sure, it’s impressive when you first see it. But the magic of these cute, bland web apps wears off after the third attempt. There’s a graveyard of simple demos created and abandoned by non-technical people at the sight of the first roadblock.
A few weeks ago, however, something interesting happened. Lovable released Lovable Cloud, giving these web apps a solid back-end. Databases, file uploads, user management, serverless functions… As of October, Lovable is no longer a toy. It’s a rapid application development tool. Kinda…
In the last few days, I’ve created a few fun, but trivial apps ranging from a cocktail-wheel-of-fortune to a SkiFree clone. I’ve made a multi-player web app to bet on the outcome of a basketball game while waiting in line to enter the stadium. Lovable Cloud can vibe code things that are actually useful.
So, rather than sticking to silly tools, I prompted it to build something non-trivial: a scanner that checks your GitHub code repos for security issues.
You pass it the URL to a GitHub repo, and it then uses Gemini to go over each file and find security or performance flaws. These are then listed in a dashboard. The app is non-trivial because it requires quite a few moving parts. Integration with an LLM, OAuth setup, GitHub security token integration, asynchronous workers to run the scan and quite some potential security issues.
After 45 minutes of prompting, it worked. Somewhat.
Not a toy, not an engineer
Whatever you think Lovable’s limits are, you are probably wrong. If you’re a developer who tried it a year ago and thinks it’s a toy, you’re wrong. If you’re a non-technical founder who believes you no longer need a dev, you’re equally mistaken. You think you can one-shot complete apps? Wrong! You believe it still takes a week to ship an MVP? Be ready for a good surprise.
Security review
Vibe coding is dangerous because inexperienced audiences don’t understand web security. They’ll put OpenAI API keys in the front-end and wonder how their account got hacked. They’ll store passwords in plain text. Lovable takes security seriously. Not only does it flag security issues before publishing, but it doesn’t let you get away with ignoring them. It even has a Fix All button that seems to work rather well.
Vendor lock-in?
Lovable has taken the Vercel route. It’s NextJS with Supabase under the hood. That’s highly productive, but this comes with a hosting cost. Right now, that’s almost free. If you’ve been involved with Cloud computing for a while, you know to be sceptical of anything free. The fine print states they will revise their pricing in early 2026, so let’s keep an eye on what happens there. There is also some risk of vendor lock-in as the code is tightly coupled to Supabase functions.
Shaky foundations
The code behind these apps is decent, but changes and incremental prompts often make things worse. The basketball betting app was updated a handful of times, and after that, the code base wouldn’t pass the average code review. API keys in the git repository, business logic in styling components, a complete lack of unit tests, the works… We will see a bunch of founders go to market quickly using these tools, only to realise they have built their product on shaky foundations. There will be real money to be made in cleaning up and maintaining these vibe-coded applications.
Techies win again
Whenever our industry has chased the dream of the wishing well, software engineers have come out on top. Visual programming, no-code and now vibe coding all follow the same pattern. These tools get marketed as a replacement for expensive engineers but end up increasing the demand for those technical skills. While it is cool that Lovable can generate an LLM-powered, serverless, database-backed code scanner, it is far from production-ready. You might flesh out the original idea by incremental prompting, but there is one wish the genie can’t grant yet: production-ready code.
Lovable Cloud pushed the state-of-the-art of prompting non-trivial apps. That’s a truly exciting position. It’s an amazing tool for building PoCs and useful demos.
That might sound negative in the age of AI hype, but it truly isn’t. Lovable will become a PM’s best friend — Prototyping at the speed of a prompt. It will also be the average developer’s first choice for quickly spinning something up.
In the coming months, we might see Lovables for all kinds of programming ecosystems. As these tools get better and more advanced, we’ll see them being adopted by PMs and engineers alike.
They will speed up product validation and boost developer productivity like never before.
They will create jobs, rather than take them.
Thanks for reading We should do something with AI! This post is public so feel free to share it.
