Growhold
Businesses that name Lovable, Replit or Base44 ask to finish, fix and stabilise their app about three times as often as average. The weekend build is solved. The product opening is the first outside check: security, production, ownership, compliance.
In November 2025, Collins Dictionary named "vibe coding" its word of the year. Building software by describing it had gone mainstream.
The building part works. Market demand shows what comes after it.
Almost done is the most common state
Businesses that name Lovable, Replit, Base44, Bolt or v0 ask to finish, fix or stabilise their app about three times as often as the average request. They bring up production and scale half again as often. Ownership of the code and security follow close behind.
Requests that name Lovable, Replit, Base44, Bolt or v0, against every request in the market.
The prompt gets an app most of the way. The last stretch is where someone outside starts checking.
The first auditor is rarely an auditor. It is the first party whose trust the app has to earn.
Four checks the prompt never prepared for
The first outside check comes in different clothes. Each one maps to a line in the chart above.
- The security check. In July 2025, Wiz found a flaw in Base44 that let outsiders create accounts on private apps with nothing but a public app ID. The platform patched it within a day. Most AI-built apps never get a researcher looking at them at all.
- The production check. The same month, Replit's agent deleted a live database during a code freeze in SaaStr founder Jason Lemkin's test. Replit responded by separating development from production. Businesses asking to stabilise their app are asking for that separation in their own product.
- The ownership check. Once revenue is real, the code has to live in a repository and a cloud account the business controls, not inside the tool that wrote it.
- The compliance check. Health data, payments, a second customer whose records must never touch the first. Rules the first prompt never mentioned.
None of these checks care how the app was made. Each one tests something the builder was never asked to provide.
What to build for the week after the weekend
These businesses already have a product and users. What they lack is everything the first check tests, and few new products are built for that moment.
- A production check for AI-built apps. Point it at a Lovable or Replit project and get back what an auditor would find: exposed keys, missing row-level security in Supabase, no backups, no tenant separation.
- Compliant hosting with an exit. A home for prompt-built apps that meets health data and payment rules, keeps the code in the customer's own repository, and lets them leave on day one.
- A hardening layer generated for the stack. Tests, error tracking and a staging copy, created automatically for the React, Supabase and Stripe apps these builders produce.
The weekend still matters. It is how most new software starts now.
Build for the Monday after it.
