How to vibe code a real app, without it looking or breaking like one
The tools, the plan, and the fixes nobody puts in the demo video.
The vibe coding playbook
Every step on this page, walked through, so you ship something you can put in front of a stranger.
What you need before you build
The honest short list. The how for each one is in the guide.
Five real conversations. Talk to five people who have the problem, not whether they would use an app.
The one core action. The single thing a user does that makes the app worth opening a second time.
Your tool picked. Matched to your technical comfort, your app's shape, and your budget, not the best marketing.
Your build spec written. Who the user is, the one core action, the data model, what success looks like. Three or four sentences.
Your data and auth needs decided. On paper, before you prompt: does this need accounts, what it stores, whose it is.
The security checklist ready. Row-level security on, no secrets in client code, tested with two accounts, before anyone else touches it.
What it costs, and what actually breaks the budget
Real ranges, no promises. This guide is about shipping an app, not a revenue business, so there is no income figure here. What you spend depends entirely on which tool you pick and how you use it.
All four tools offer a free tier: daily or monthly credits, or a monthly token allotment, enough to build and test a first version.
Cursor's entry paid tier runs $16 to $20 a month. Lovable, Bolt.new, and Replit's entry paid tiers run $20 to $25 a month.
Higher tiers add more credits or tokens, more collaborators, and premium models as your usage grows.
Token and credit usage on complex features, not the sticker price. A complex feature can burn through a monthly allowance faster than expected, especially on tools with less predictable usage costs. Prices and credit allotments change often on all four platforms, confirm the current number on the tool's own pricing page before you commit a monthly budget.
Get the tool-choice scorecard
Score all four tools against your actual project, the build-spec worksheet, and the full pricing comparison. All of it.
Check your app before anyone else touches it
This is the step vibe coding tutorials skip because it isn't fun and it isn't in the demo video. A well-documented 2025 vulnerability affected a large number of Supabase-backed apps built with AI tools, most sharing the same root cause: a database table left without row-level security turned on. None of this requires you to become a security engineer. It requires you to actually look, in your tool's own dashboard, before you send the link to anyone outside your own account.
Read Supabase's own row-level security docs
Supabase, the database most of these tools connect you to by default, publishes its own documentation on row-level security: what it is, how to turn it on per table, and how to confirm it is actually working. It is maintained directly by Supabase, so it stays current in a way a guide like this one cannot promise to.
Test it yourself, not just by reading. Create two test accounts, log in as each one, and try to view the other account's data directly. If you can see it, your access rules are not set up yet, no matter how polished the login screen looks. And if this app turns into something you charge for, registering the business itself is a separate step with its own rules; BUILD has a dedicated guide that walks through exactly that.
Shipping the app is the finish line for this guide. BUILD is the starting line for the business, if that's where you're headed.
Frequently asked questions
What is vibe coding?
Building software by describing what you want in plain language and letting an AI agent write and run the code, rather than writing it yourself line by line. Andrej Karpathy popularized the term in a post on X in February 2025.
Which tool should I use, Lovable, Bolt.new, Replit, or Cursor?
Score each against your actual project: your technical comfort, the shape of your app, your budget, and whether you need to export the code later. Lovable is fastest for a standard, SaaS-shaped app. Bolt.new gives the most direct control and exportable code. Replit is built for custom backend logic and non-standard languages. Cursor is the right fit once you are editing code yourself, not just prompting for it. The highest score is your starting tool, not your forever tool.
How much do these tools cost?
All four offer a free tier. Paid plans start around $16 to $25 a month depending on the tool, with usage-based credits or tokens on top of the base price. Prices and credit allotments change often on all four platforms, so confirm the current number on the tool's own pricing page before you commit a monthly budget.
Is it safe to launch an app built with AI tools?
It can be, if you check it first. A well-documented 2025 vulnerability affected a large number of Supabase-backed apps built with AI tools, most sharing the same root cause: a database table left without row-level security turned on. That is not a reason to avoid these tools, it is a reason to run the security checklist every time, since the tools will not run it for you.
Why does my app look like every other AI app?
Every AI app builder trains on similar patterns, so every default output leans toward the same look: centered layouts, a purple-to-blue gradient hero, generic stock icons, and rounded corners paired with drop shadows on everything. Kill the default gradient, commit to a specific two- or three-color palette, and give the tool a specific style prompt naming a real product you like, instead of asking it to make it look professional.
What do I do when my AI-built app breaks?
Work a repeatable ladder instead of panicking: read the actual error message, check your browser's console for anything in red, ask for a review of the specific file instead of the whole app, roll back to the last working version before you rebuild, and rebuild only the broken piece, not the whole project. Most bugs resolve in under ten minutes once you stop panicking and start working the ladder in order.