Lovable vs Bolt vs Replit Agent vs v0: what each one leaves you to finish
All four generate working interfaces quickly. They differ in what they leave undone. Lovable and Bolt hand you a Supabase database with access rules switched off. Replit Agent gives you a running server but its own hosting. v0 generates interface components with no backend at all.
Part of the guide to shipping an app built with an AI coding tool.
What each one actually gives you
| Tool | Generates | Backend | Leaves you |
|---|---|---|---|
| Lovable | Full app with screens and data | Supabase, wired up | RLS policies, secrets handling, your own hosting |
| Bolt | Full app in the browser | Supabase or none, your choice | Same as Lovable, plus deciding the backend yourself |
| Replit Agent | Full app plus a running server | Whatever it scaffolds | Moving off Replit hosting, production database config |
| v0 | Interface components | None | The entire backend, auth and data layer |
| Cursor / Claude Code | Whatever you direct | Whatever you direct | Everything you did not think to ask for |
Why the last two are a different category
v0, Cursor and Claude Code are not really in the same comparison. v0 generates interface pieces and never claimed to do more, so nobody is surprised when there is no backend. Cursor and Claude Code do whatever you direct, which means the gaps are wherever your own knowledge ran out rather than wherever the tool stopped.
That makes them safer in one respect and riskier in another. A developer using Cursor tends to know what is missing. A non-technical founder using Cursor generally does not, and the tool will not volunteer it.
The failure they share
Whichever you picked, the same four things are usually left for you:
- Access rules on the database. Supabase ships tables with Row Level Security disabled, and none of these tools turns it on for you.
- Server-side permission checks. The interface hides what you should not see; the server frequently does not refuse to send it.
- Secrets that are not the intended public ones. A Supabase anon key belongs in the browser. A payment or AI provider key does not.
- Deployment you control. Every one of these has a hosted preview that supplies configuration your own host will not.
Which should you use?
For getting to something real quickly, any of them works. The choice matters far less than people expect, because the gap you will hit is the same in every case. Pick the one whose editing experience you prefer and plan for the last stretch separately.
The one genuine differentiator: if you are not technical, avoid the tools that give you the most freedom. v0, Cursor and Claude Code assume you know what a finished system needs. Lovable and Bolt assume less, which means fewer ways to go wrong without noticing.
Does switching tools fix anything?
No. Rebuilding the same app in a different tool produces the same category of gaps, plus the cost of the rebuild. The work that closes the gap — access rules, server-side checks, secrets, deployment — is the same work regardless of which tool generated the code.
Abhinav Chaudhary
Co-founder — UX/UI and frontend. Builds the part people actually touch. On a rescue job that usually means the login flow, the error states an AI tool never generated, and the screens that break the moment someone does something unexpected.
Want someone to look at yours?
Send us the repo or the live URL. You get a written list of what is broken, what each fix costs and what can wait — back within 24 hours, and yours to keep either way.
Get a $99 audit