Lovable, Bolt, and v0 Assess
Overview
Lovable, Bolt, and v0 generate full-stack or UI prototypes from natural language for rapid product discovery (Lovable, Bolt, v0).
Assess for prototypes and design spikes. Generated code should not reach production without security review, tests, and architectural alignment. Vercel's v0 has moved from v0.dev to v0.app and, since February 2026, runs in a sandbox that can import existing GitHub repositories (Introducing the new v0).
Adoption Signals
- Lovable raised a $400M Series C at a $13.3B valuation on 12 August 2026, led by Menlo Ventures and co-led by the EQT-managed Scaleup Europe Fund; it reports more than 60 million projects, over 900 million monthly visits to apps built on it, and customers including Adidas, NVIDIA, Deutsche Telekom, and Zendesk (Antler press release).
- Bolt.new (StackBlitz) announced Azure deployment, Microsoft 365 and Teams integration, Microsoft Entra identity, and Microsoft Marketplace procurement on 5 May 2026, citing Digital Virgo cutting a streaming app's development timeline from 12 months to 3–4 months (Bolt.new on Microsoft Azure).
- Bolt Cloud (August 2025) bundles hosting, databases, authentication, and payments; StackBlitz raised a $105.5M Series B in January 2025 (Sacra: Bolt.new).
- The new v0 (3 February 2026) added a Git panel with a branch per chat, pull requests against main, deploy on merge, and integrations with Snowflake and AWS databases (Introducing the new v0).
Risks
- Insecure generated backends. CVE-2025-48757 (CVSS 9.3) covers insufficient row-level security in Lovable-generated Supabase projects; researchers could read or write data in 170 of 1,645 scanned apps. Lovable disputes the CVE, placing responsibility on each app owner (CVE-2025-48757).
- Shadow IT with real data. RedAccess found about 5,000 apps built on Lovable, Replit, Base44, and Netlify that were reachable by URL or behind a simple email sign-in, with roughly 40% exposing data such as medical records, financial data, or strategy documents (Wired via Freevacy).
- Platform coupling. Each tool bundles its own hosting, database, and auth; moving a successful prototype onto company infrastructure usually means replacing those layers.
- Data leaving the company. Prompts, uploaded documents, and connected databases are processed by the vendors' SaaS platforms and their model providers, which needs a data-processing agreement and a data-classification rule before business data is used.
- Maintainability. Code produced through long prompt chats tends to lack tests and consistent architecture, so a prototype that is kept alive becomes technical debt quickly.
Pros & Cons
Advantages
- Very short path from idea to clickable, deployed app: product managers and designers can validate flows with real users in hours, and Lovable reports more than 60 million projects created on its platform since late 2024.
- The tools now reach into enterprise stacks: Bolt.new deploys to Azure with Microsoft Entra identity, v0 imports existing GitHub repositories and opens pull requests, and Lovable lists Adidas, NVIDIA, Deutsche Telekom, and Zendesk as customers.
- Output is ordinary React/TypeScript code in a Git repository, so a validated prototype can be handed to engineering instead of being rebuilt from screenshots.
Disadvantages
- Generated backends are often insecure by default: CVE-2025-48757 (CVSS 9.3) found missing Supabase row-level security in 170 of 1,645 scanned Lovable apps, and Lovable disputed it as the customer's responsibility.
- Anyone in the company can publish a live app with real data outside IT control; an August 2026 study found about 5,000 publicly reachable vibe-coded apps without real authentication, around 40% leaking sensitive data.
- Hosting, databases, and auth are bundled into each vendor's platform (Lovable hosting, Bolt Cloud, Vercel), which makes prototypes easy to launch and hard to move under corporate security and data-residency rules.
Recommendation
Assess Lovable, Bolt, and v0 as prototyping tools for product discovery: clickable demos, design spikes, and throwaway internal tools that use synthetic or public data only. Set up an approved account with SSO, a rule that no personal or customer data goes into prompts or connected databases, and a default of private (not public) sharing before teams start.
Promotion to production is a separate engineering decision: the generated repository goes through the normal pipeline with code review, tests, security scanning, and a check of database access rules, and hosting moves to the company's own platform. Compare with Figma Make for design-led prototyping and Replit Agent for internal apps; uncontrolled rollout to non-engineers is the anti-pattern described in the radar entry on AI-accelerated shadow IT.
Sources
Consulting
From radar to implementation
You have assessed the technologies — we help you bring them into production systems safely and measurably.
