What we found auditing 30 AI-built apps
Over the past year we've audited 30 apps built primarily with Lovable, Bolt, v0, Cursor, or Replit. Every one of them worked. Every founder had validated something real. And 27 of the 30 shared the same top four findings, which is the most encouraging statistic in this post: consistent problems have rehearsed fixes.
Before the numbers, the framing that matters: none of this means the prototypes were mistakes. They did their job. These findings are what “the job” doesn't include.
The numbers
The pattern behind them
Codegen tools optimize for the demo, because that's what you can see and iterate on. The result is code that looks complete and is structurally missing its production half. Here's a route we see, in some form, in most audits:
// generated route — looks fine, isn't
app.post('/api/orders', async (req, res) => {
const order = await db.orders.create(req.body);
res.json(order); // no auth, no validation,
}); // no idempotency, no loggingAny logged-in user, or in some cases anyone at all, can create orders with arbitrary fields.
Auth middleware on the router, a validation schema on the body, and an ownership check before the write. Rehearsed fix; we've shipped it 24 times.
What this means for your app
If you built with these tools, your app almost certainly has some of the findings above. That's not a verdict on you or the tools; it's the current shape of the gap between prototype and product. The gap is finite, well mapped, and in our experience closes in about four weeks.