There is a specific moment every stuck founder describes the same way. The app was nearly done. Then one bug appeared, the AI fixed it and broke something else, fixed that and resurrected the first bug, and somewhere around attempt fifteen you realized the app is further from done than it was two days ago, and you are afraid to

The builder platforms bundle hosting into the subscription, which makes the cost question invisible right up until the app matters. Then it arrives from two directions at once: credits burning faster as usage grows, and the discovery that hosting an app yourself involves five services you have never priced. Here are the real numbers on both paths, in 2026 dollars,

Most AI app builders sit on Supabase or something shaped like it, which makes Supabase security the single most consequential topic in this whole series. It is also the most misunderstood, because Supabase inverts an assumption people carry in from older stacks: the database is reachable from the browser on purpose, the API key in your frontend is public by

Lovable hosts your app by default, and for a prototype that is the right call. Then the app becomes real and the reasons to hold your own infrastructure stack up: hosting draws from the same credit balance you want to spend on building, a business wants predictable costs and its own perimeter, and control of the domain, the deploys, and

The security incidents that have defined the AI app era were not sophisticated attacks. In 2025, the Tea app exposed tens of thousands of user images, including photo IDs, through a storage bucket that was configured to be publicly readable. The same year, security researchers scanning apps built with AI tools found user data readable in a meaningful share of

Vibe coding is real: describe what you want, and Lovable, Bolt, v0, Replit, or Claude builds something that runs. The demo works, the screens look right, and the distance between idea and working software has never been shorter. Then you consider letting strangers use it, maybe pay through it, and a different question appears: what separates this from software a