Guides: test and secure your AI-built app

Short, practical how-tos for people shipping apps made with AI builders and coding agents. Where we have our own test results, the guides show the receipts. Where we don't, they say so and link the official source.

Guides

• Checklist · receipts from test v1

  How to test your AI-built app before launch

  A 12-step checklist for apps made with Lovable, Bolt, Base44 or v0, about 45 minutes by hand. Each step that has one is tied to a bug our v1 test found (16 Oct 2026), like edit buttons that only showed on mouse hover and a session that survived logout.

• Step by step · receipts from test v1

  Can user A see user B's data? The two-account test

  Eight steps with two accounts and two browser windows to check whether one user can see or change another user's data. Includes pass/fail signs, example fix prompts and our v1 receipts: all four builders' apps passed.

• Docs-based guide · not a test

  Give every AI coding tool its own API key and a spend cap

  Where OpenAI, Anthropic, the Gemini API, OpenRouter and Vercel AI Gateway let you put a hard spending cap (project, workspace or single key), how to set it, and how to rotate a leaked key. Built from each provider's docs, read 19 Oct 2026.

• Methods comparison · receipts from test v1

  Security scan vs functional test: what AI app scanners check

  What PreflightVibe, PreflightX, Prodable, Shippable and SafeWeave say they check (read 20 Oct 2026), next to a functional test, plus the bugs from our v1 test that a logged-out scan can't see, like hover-only buttons and a stuck sign-up.

Related research and tools

• Lovable vs Bolt vs Base44 vs v0 (test v1)

  Our same-prompt test on free plans, 16 Oct 2026, one run per tool, with scores and screenshots. The receipts the guides above point to come from here.

• Cost per working app

  What one working multi-user app used on each builder's free plan in test v1: 2.10 Lovable credits, about 101K Bolt tokens, 1 Base44 message credit and $3.81 of v0 credit.

• Do AI app builders train on your app?

  Each builder's AI-training default and how to opt out, from its own docs (checked 17 Oct 2026). Bolt and Lovable have a free opt-out; Base44 excludes only Enterprise.

• Pricing and free plan limits

  Every plan and free-plan limit for Lovable, Bolt, Base44 and v0, re-read on the vendors' pages on 18 Oct 2026, next to what one app actually used in our test.

• Tested alternatives

  Alternatives pages for each builder, built only from test v1 data. Builders we haven't tested are listed as not tested, with no claims.

• Feature comparison

  Which builder has built-in sign-in, a database, custom domains, code export, private apps and mobile output, and on which plan, with a source link per cell (read 18 Oct 2026).

• Scan my app (free beta)

  A real browser checks up to 5 pages of your app: phone layout, safe buttons, junk input, console and network errors. Guest mode only, writes blocked, and it never affects any ranking.

How these guides work: results marked Observed come from our own runs (test v1: 16 Oct 2026, free plans, one run per tool, so a single observation). Verified means read on the vendor's or provider's official page on the date shown. Harder v2 results aren't published yet, so no guide makes v2 claims. How we test · Disclosures. Payment never buys rank.