Built your app with AI? Lovable, Bolt, Replit, Cursor, Claude Code or Codex: what breaks before launch and what it costs to fix (UK 2026)

Built an app with Lovable, Bolt, Replit, Cursor or Claude Code? What breaks before launch, a pre-launch checklist and what fixing it costs in the UK.

Last checked 21 October 2026. Vendor documentation changes quickly; every statement about a tool below is taken from that vendor's own documentation.

This is the tool-specific, priced follow-up to our general guide, How to prepare a vibe coded app for launch. This one is tool-specific: what breaks in each family of tools, how to check it, and what fixing it costs.

Is my AI-built app ready to launch?

Not until it passes a short checklist, and most prototypes do not pass on the first attempt. That is not a criticism of the tools: they are excellent at putting a working screen in front of a customer in days. The gap appears when real people, data and money arrive, and the things a prototype can ignore (who may read which record, what happens when a payment arrives twice) become the product.

The tools fall into two groups, and they fail in different ways.

Is my Lovable, Bolt or Replit app secure?

It can be, but the platform does not guarantee it, and the vendors say so. Lovable's documentation states that its security scans "support secure application development, but they do not replace a thorough security review" and "cannot guarantee complete security". It tells users they are responsible for the security requirements of their use case and recommends an additional professional review for apps that handle sensitive data. Two issues come up more than any other.

1. Database access rules. Many builders use Supabase (Postgres) as the database. Supabase's documentation says to "enable RLS on every table in an exposed schema" and that a table without Row Level Security "is readable and writable by any role with a grant on it", including the public anon role. Once RLS is on, "no data is accessible through the API when using a publishable key, until you create policies". Lovable's own docs add that "misconfigured RLS rules are a common cause of data leaks". In plain terms: if RLS is off or the policies are too open, anyone who finds your project URL and public key may be able to read or change other users' data.

2. Secrets in the browser. Lovable's docs state that "API keys and other secrets cannot be stored safely in client-side code". Supabase says "never use a secret key in the browser" because the service_role key bypasses RLS. Replit's checklist says to use Replit Secrets and keep credentials server-side. A key found in the browser bundle should be treated as leaked and replaced.

The other platform risks are commercial. Lock-in: Lovable offers two-way GitHub sync and, on paid plans, direct codebase download; Bolt documents GitHub sync. Confirm the exported code builds and runs outside the platform before you depend on it. Cost: Bolt meters usage in tokens, and Replit publishes deployment prices (Autoscale is a $2 a month base fee plus usage; a Reserved VM with 1 vCPU and 4GB RAM is $35 a month). Modest at prototype scale; recheck against real traffic.

Why did my app break when real users arrived?

Because prototypes are built for one user doing the happy path. The failures that show up with the first real users are rarely exotic:

Typical culprits: slow work (uploads, AI calls, emails) done inside a single request and timing out; auth edge cases such as password reset and expired sessions; no logging or monitoring, so you hear about failures from customers; backups that were never test-restored; and usage costs that scale with traffic.

Is an app built with Claude Code, Codex or Cursor production-ready?

The code is yours, which is the advantage, but nothing in these tools reviews it for you. Anthropic's Claude Code documentation says: "You're responsible for reviewing proposed code and commands for safety before approval." GitHub says of Copilot that it "may not identify all of the problems that are present in code", that generated code may "appear to be valid but may not actually be semantically or syntactically correct", and that users should "always carefully review and test code generated by Copilot". A non-developer building alone has no one to do that review.

What we typically find missing in agent-built code, and what you can check:

• Tests. If the repository has no automated tests, every change is a gamble. Ask the agent how many exist and run them.
• Architecture. Business rules scattered everywhere, so changes break unrelated features.
• Dependencies. Packages the agent added without checking that they exist, are maintained and are what they claim to be. Run npm audit (or your language's equivalent), as Replit's security checklist also advises.
• Operations. No error handling, logging or monitoring; a server or cloud account left open to the internet; no CI/CD to test and deploy safely.

Claude Code includes a /security-review command for an on-demand pass over the changes on your branch, and Lovable has a Quick scan and a Deep scan. Treat them as first filters, not a review.

What breaks in every tool: payments, privacy and performance?

Payments are the most expensive thing to get wrong. Stripe's documentation says a webhook endpoint must verify the Stripe-Signature header, return a 2xx quickly, and handle duplicates: "webhook endpoints might occasionally receive the same event more than once", so you should log processed event IDs. Stripe retries failed deliveries for up to three days, does not guarantee event order, and supports idempotency keys so a retried request is not performed twice. A prototype that trusts the browser for "paid", or processes an event twice, will eventually charge or ship wrongly.

UK GDPR applies from the first real user. The ICO's security principle requires "appropriate security of the personal data", with technical and organisational measures suited to the risk. A notifiable personal data breach must be reported to the ICO "without undue delay, but not later than 72 hours after becoming aware of it". The ICO also states that organisations, including sole traders, that use personal information need to pay a data protection fee unless exempt. In practice: a privacy notice, a record of what you collect and where it is stored, processor terms with your platform, and a way to delete a user's data.

Pre-launch checklist: what to check yourself

Can I put an AI-built app on the App Store or Google Play?

Yes, but a wrapped website or a thin prototype is likely to be rejected. Apple's App Review Guidelines, 4.2 Minimum Functionality, say an app should "include features, content, and UI that elevate it beyond a repackaged website" and that apps that are not "particularly useful, unique, or 'app-like'" do not belong on the App Store. Guideline 2.1 says Apple will "reject incomplete app bundles and binaries that crash or exhibit obvious technical problems" and requires demo account details (with your back end switched on) if the app has a login. Guideline 5.1.1(v) requires that an app supporting account creation also offers account deletion within the app. Our Apple Developer fee guide covers the account cost.

Google Play has its own gate: for personal developer accounts created after 13 November 2023, Google requires a closed test with at least 12 testers opted in continuously for at least 14 days before you can apply for production access. Plan that into your timeline.

Should I fix it, harden it or rebuild it?

Decide on the structure, not on how the app looks. Screens are cheap to change; the data model, access rules and payment logic are not. These are our criteria, not a formula; a Discovery sprint confirms which row you are in.

A rebuild does not throw the prototype away: the screens and flows you proved with real people become the brief. See our MVP development page.

How much does it cost to make an AI-built app production-ready?

At Magora's published prices, a first scoping step is from £3,000 and a rebuilt production-grade MVP is from £10,000. We do not publish a fixed price for auditing an existing AI-built app, because the effort depends on what is in it. The honest entry point is a Discovery sprint, which gives you a written assessment, a plan and a fixed-price quote for whichever route applies.

For a sense of scale on hardening, here is plain arithmetic at the published day rate, not a quote and not a claim about how many days your app needs: 5 developer-days is about £1,950, 10 days about £3,900, and 20 days (a full-time developer-month) about £7,800. Discovery establishes how many days your app needs. Use the app cost calculator for a first rough figure on a rebuild.

Who maintains an AI-built app after launch?

You do, unless someone is contracted to. Dependencies need updating, platform and operating-system changes break things, and app stores keep changing their rules. Decide before launch who is on call and who holds the admin accounts. A maintenance retainer starts from £1,000 a month at Magora (about £12,000 a year); our maintenance cost guide shows what it covers.

What should I do next?

Work through the checklist this week. If you find red flags on secrets, access rules or payments, get an independent review before inviting users. Send us the prototype or repository and we will build a free coded prototype of your core idea in 5–10 working days, or start with a two-week Discovery sprint from £3,000. Get a free coded prototype or book a Discovery call.

FAQ: AI-built apps and going live

Is my Lovable app ready to launch?

Only if it passes the checklist above. Lovable's own documentation says its scans do not replace a thorough security review, and recommends an additional professional review for apps handling sensitive data. Check RLS, secrets and authentication first.

Is a Supabase database from Lovable or Bolt secure by default?

Not necessarily. Supabase says a table in an exposed schema without Row Level Security is readable and writable by any role with a grant on it. Enable RLS on every table and write policies, then test as a second user.

Can I export my code from Lovable, Bolt or Replit?

Lovable offers two-way GitHub sync and, on paid plans, direct download; Bolt documents GitHub sync. Check your own plan and confirm the exported code builds and runs outside the platform before relying on it.

Can I put an AI-built app on the App Store?

Yes, if it is a real app. Apple's guideline 4.2 rejects apps that are no more than a repackaged website, 2.1 rejects apps that crash or are incomplete, and 5.1.1(v) requires in-app account deletion where accounts can be created. Google Play requires a 14-day closed test with 12 testers for newer personal developer accounts.

Should I rebuild or fix my AI-built app?

Fix or harden if the data model is sound and the issues are rules, secrets, tests and monitoring. Rebuild if the data model or structure is wrong, you must leave the platform, or you need native apps. A rebuild at Magora starts from £10,000 (a startup MVP in 6–8 weeks).

How much does it cost to make an AI-built app production-ready?

Magora's published entry points are a free coded prototype, a Discovery sprint from £3,000, a startup MVP from £10,000, and developers from £49 an hour (about £390 a day). We do not publish a fixed audit price because it depends on the app; Discovery gives a written assessment and fixed quote.