Stuck at 80%: why apps built with AI tools stall, and how to finish them
Your Lovable, Bolt or Replit app demos fine but will not launch? Where AI-built apps get stuck, what the numbers say, and a plan to finish it.
Why does my app work in the demo but not for real people?
Because the AI builder made the part you can see. The part you cannot see is still missing.
The screens, the buttons and the look come fast. A login that works for a stranger, a payment that really charges, data that only the right person can read, a live address, the app stores: none of that is on the screen, so none of it is in the demo.
Addy Osmani at Google wrote in December 2024 that people who cannot code "get 70% of the way there surprisingly quickly" (Osmani, 2024). Justin McKelvey, who fixes these apps for a living, wrote in August 2026 that every one "demos at 100% and is built to about 80%". The half-built apps that reach me have the same shape. I call it the 80% wall.
How many people build apps with AI tools in 2026?
Millions, and most of them never wrote a line of code.
Lovable, the biggest of these builders, reported 100,000 new projects a day in July 2025 (Lovable, 2025) and over 200,000 a day by March 2026 (TechCrunch, 2026). By August 2026 it counted 60 million projects (Lovable, 2026). Lovable says 80% of its builders are in non-technical roles (Lovable, June 2026). Replit says it has more than 50 million users (Pulse 2.0, March 2026). A Zapier survey of about 800 US workers in May 2026 found that one in three people building tools with AI at work has no programming background (Zapier, 2026).
New Lovable projects per dayCompany numbers. Compare the direction, not the exact size. 2027 is my guess, so it has no number.
- Earlier
- Now (2026)
- My guess
60Mprojects on LovableLovable, August 2026
80%of Lovable builders are in non-technical rolesLovable, June 2026
50M+Replit usersReplit, March 2026
1 in 3people who build tools with AI at work have no programming backgroundZapier survey, May 2026
See the numbers
| What | Number | Source |
|---|---|---|
| New Lovable projects a day, July 2025 | 100,000 | Lovable blog |
| New Lovable projects a day, March 2026 | over 200,000 | TechCrunch |
| Lovable projects in total, August 2026 | 60 million | Lovable blog |
| Lovable builders in non-technical roles | 80% | Lovable, June 2026 |
| Replit users | more than 50 million | Pulse 2.0, March 2026 |
| Workplace AI builders with no programming background | 34% | Zapier, May 2026 |
My guess for 2027: more of the same, and more half-built apps with it. Gartner expects companies to make 40% of new production software with these tools by 2028 (Gartner via CIO Dive, 2025).
Where AI-built apps get stuck: login, payments, data, going live
In six places. The builders' own documents say so.
- 1Login
- 2Payments
- 3Data rules
- 4Live address
- 5App stores
- 6The bug that returns
- Login. Lovable's guide tells you to turn off email confirmation while testing and to "Re-enable it before launching to real users" (Lovable docs). Many people never do. Sign-up works and login does not.
- Payments. Lovable's Stripe page says "The portal does not work inside the Lovable preview panel", and with a live key "payments made from the preview are real" (Lovable docs).
- Data rules. The same docs: "Missing RLS policies are the most common way app data gets exposed". RLS is the rule that says which user may read which row.
- Live address. Changes are not pushed to the live app by themselves, and a custom domain needs a paid plan (Lovable docs).
- The app stores. Lovable builds web apps, "Not as native apps" (Lovable FAQ). Google Play makes a new personal account run a closed test with 12 testers for 14 days (Google Play). Apple's rule 4.2.6 rejects apps from "an app generation service" unless the provider submits them (Apple), and in 2026 Apple held back updates of several vibe-coding apps for months (The Decoder, TechCrunch).
- The bug that comes back. That is the next question.
In the Zapier survey, the two most common problems for builders without a coding background were bugs (38%) and security and privacy (37%).
| Who | Step | What their own page says |
|---|---|---|
| Lovable | Payments | "The portal does not work inside the Lovable preview panel" Stripe docs |
| Lovable | Data rules | "Missing RLS policies are the most common way app data gets exposed" Supabase docs |
| Lovable | Live address | "Connecting a new custom domain requires a paid plan." Publish docs |
| Lovable | App stores | "Not as native apps." FAQ |
| Bolt | Payments | "Stripe integration requires edge functions and doesn't work with Firebase." Bolt support |
| Bolt | Payments | With token checks on, "your webhook calls from external services will fail with an authorization error." Bolt support |
| Replit | Secrets | "Replit keeps development and production secrets in separate stores, and changing one doesn't update the other." Replit docs |
| Replit | Live address | Works in preview, not live: "This is almost always a configuration difference between environments." Replit docs |
| v0 | Login | A user, February 2026: "now i have authentication implemented and in v0 i cant seem to get it working." Vercel community |
| Apple | App Store | Rule 4.2.6: apps from "an app generation service will be rejected unless they are submitted directly by the provider". Guidelines |
| Google Play | Play Store | New personal accounts: "Run a closed test with at least 12 opted-in testers continuously for 14 days". Play Console Help |
Why does the AI keep breaking what it just fixed?
Because each fix is a guess, and each failed guess goes back into the next prompt.
Founders tell me the same story. The AI can no longer see the whole app at once. It fixes the form and breaks the save. You paste the error, it fixes the save and breaks the form. Osmani called this "the two steps back pattern". A Cursor user in April 2025 described being stuck in a loop: fix, break, fix the first thing again (Cursor forum). Kerry Vaughan-Rowe named the reason in July 2025: each prompt feeds the AI "the text from its past failures", so it keeps "tunnelling on whatever didn't work seconds ago" (Vaughan-Rowe, 2025).
The builders know this. Lovable gives you ten free fixes, then fixes cost credits, and its own advice is to use "Try to fix" once or twice, then investigate, plan or revert (Lovable FAQ, Troubleshooting). The way out of the loop is to stop prompting and read the code. Reading code is an engineer's job.
Is a vibe coded app secure? The 2025 and 2026 numbers
Not by default. The number did not move in a year, so this is the first thing to check.
Veracode tested more than 100 AI models on 80 coding tasks in 2025. The code had a security flaw in 45% of cases (Veracode, 2025). Its 2026 report puts the pass rate at 56%, "barely changed from 55%", while the code now runs correctly "nearly 100% of the time" (Veracode, 2026). Working and safe are different things. A university audit in 2026 of 200 live apps built with Claude Code and Lovable found that 91% had at least one vulnerability (Deng, Fan and Meng, 2026).
AI-written code that passes security testsVeracode, 2025 and 2026. 2027 is my guess.
- 2025
- Now (2026)
- My guess
nearly 100%of the code runs correctlyVeracode, 2026
91%of 200 audited live apps had at least one vulnerabilityDeng, Fan and Meng, arXiv, 2026
See the numbers
| What | Number | Source |
|---|---|---|
| Security pass rate, 2025 (flaw in 45% of cases) | 55% | Veracode, July 2025 |
| Security pass rate, 2026 | 56% | Veracode, July 2026 |
| Code that runs correctly, 2026 | nearly 100% | Veracode, July 2026 |
| Audited live apps with at least one vulnerability (200 apps) | 91% | Deng, Fan and Meng, arXiv, 2026 |
Two cases from 2025 show what that means. In May, a researcher reported 170 Lovable apps with open database rules, so a stranger could read or change other users' data (Palmer, 2025). Lovable answered with an automatic security scan before every publish (Lovable, 2025). In July, a Replit agent deleted a company's production database during a code freeze (eWeek, 2025). Replit split development and live databases within days (The Stack, 2025). The builders fixed their side. Your app still needs its own check.
My 2027 guess: the pass rate stays near 56% until a person checks each app. Better models write code that runs. They do not yet write code that is safe by default.
Fix or rebuild a vibe coded app? Walk through this tree
Finish it, unless the data model is wrong.
1Does the data model match what the business does?
NoRebuild
2Can an engineer read the code in a day?
NoRebuild one part, piece by piece
3Can login and data rules be fixed without changing the data model?
NoRebuild one part: login and data rules
4Does the main user journey work from start to end?
NoFinish it: the journey first
5Is the app already used by real people?
Yes or noFinish it, and keep it running while you fix
Rewriting from scratch throws away everything the app already learned from real use. Joel Spolsky called it "the single worst strategic mistake" a software company can make, back in 2000, and his reason still holds: "It's harder to read code than to write it" (Spolsky, 2000). Martin Fowler's advice is to replace one piece at a time while the old app keeps running (Fowler, 2024). The one real trigger for a rebuild, in the words of one rescue team's self-test, is a data model that "cannot express what the business now does" (dev.to). Finishing an app costs far less than building it again, in money and in weeks, and it keeps the customers the app already has.
How to finish a vibe coded app: the plan and the timeline
An audit first, then four fixed steps, then the stores.
- AuditOne to two days. Read the code, run the security scan, list what is missing.
- Data rules and secretsWho may read which row. Keys out of the browser code.
- Login and paymentsTested with real keys on a test account.
- Tests and a reviewThe bug that returns gets a test.
- Live addressThen the stores.
small fix sprintfull finish
- Google PlayNew personal account: a closed test with 12 testers for 14 days.
- Apple90% of apps are reviewed within 48 hours.
The audit takes a day or two: read the code, run the security scan, list what is missing. Then come data rules and secrets, login and payments tested with real keys on a test account, tests and a review, and the live address. Public rescue pages quote one week for a small fix sprint and up to eight weeks for a full finish. The stores add their own clock. Apple's program costs US$99 a year (Apple) and reviews 90% of apps within 48 hours; over 40% of its unresolved issues are "App Completeness", which means crashes and placeholder content (Apple App Review). Google Play costs US$25 once (Google Play), plus the 14-day test for new accounts.
Moving to another tool is not a shortcut. Replit's own guide for importing a Lovable app says "Existing database records are not migrated" and keys "must be added separately" (Replit docs).
This is the work I do with my agent team: take over the code, finish the invisible part, go live.
Watch: an agent team takes over a stuck app
This is how a build runs with my agent team.
What should I do this week?
Three things, before you type another prompt.
- Export the code to GitHub.Every builder can do this. Now the app is yours.
- Run the builder's security scan.Read every line of the result.
- Get a one-day audit by an engineer.The list it produces is the finish plan.
Questions people ask
Can I take my Lovable app somewhere else?
Yes. Export it to GitHub; Replit can import it. The database rows and the keys do not travel with it; they are set up again.
Why does the app work for me but not for a friend?
Login and data rules were tested on one account, yours. Email confirmation is often still off from testing, and the data rules may let every user see every row.
Will Apple accept an app made with an AI builder?
A wrapped website will struggle under rules 4.2 and 4.2.6. An app with its own features goes through the same review as any other app.
How long does finishing take?
One week for a small fix sprint to eight weeks for a full finish, by the public pages of rescue services. For your app, the honest answer comes after the audit.
The demo was the easy 80%. The last part is a known list, and it is where an engineer and an agent team do their real work. See how I can help or talk to me.
Stuck at 80%? Let's finish it.
I take over apps built with AI tools, finish the part you cannot see, and put them live, with my agent team. I lead every project myself, from start to finish.
Sources. Osmani, "The 70% problem", 4 Dec 2024. McKelvey, "Is Lovable worth it in 2026?", 6 Aug 2026. Lovable blog, 23 Jul 2025, 9 Jun 2026, 12 Aug 2026; TechCrunch, 23 Mar 2026. Replit via Pulse 2.0, 11 Mar 2026. Zapier, "34% of AI builders have no formal training", May 2026. Gartner, "Why vibe coding needs to be taken seriously", May 2025 (via CIO Dive). Lovable docs: Supabase, Stripe, Publish, FAQ, Troubleshooting. Bolt support; Replit docs; Vercel community. Google Play Console Help; Apple App Store Review Guidelines, 8 Jun 2026; Apple App Review; The Decoder, 18 Mar 2026; TechCrunch, 1 May 2026. Cursor forum, 6 Apr 2025. Vaughan-Rowe, "Debugging decay", 30 Jul 2025. Veracode, 30 Jul 2025 and 28 Jul 2026. Palmer, CVE-2025-48757, 29 May 2025. Lovable, "Secure vibe coding", 9 Jun 2025. eWeek, 22 Jul 2025; The Stack, 21 Jul 2025. Deng, Fan, Meng, arXiv 2606.23130, 2026. Spolsky, 6 Apr 2000. Fowler, "Strangler Fig Application", 22 Aug 2024. Replit docs, "Import from Lovable".
