An AI prototype is not a product. This is the gap.
Lovable, Bolt, v0 and Cursor will get you something that demos beautifully — genuinely. Build the prototype yourself; you'll learn what you actually want. But between that demo and a product with real users there is a gap, and we've taken enough of these apart to know it's the same seven places every time. Here they are, so you can check your own.
Want your own scored against these seven? Free 30-minute teardown: we tell you which rows apply to your prototype and roughly what each one costs to fix. No obligation, and you keep the notes either way.
Get the teardown →We measured it: 163 AI-built apps, scanned.
Public Lovable-generated repos, checked against these seven gaps with our open-source scanner (npx bowline-check). Static analysis, nothing executed, no apps named. The full write-up is coming; the headlines:
98%
have no error monitoring of any kind. The first they'll hear of an outage is a user.
84%
of the apps with accounts have no account-deletion path — an automatic App Store rejection since 2022.
9%
ship real API keys — OpenAI, Google, Stripe — in public source. One in eleven.
18 of 20
apps calling LLM APIs had no rate limiting at all. The £400-overnight class of bug, measured.
36%
of the apps with a database have no migrations — every schema change gambles with live data.
79/100
median score. Not broken — unfinished. Which is exactly what a prototype is supposed to be.
The tools aren't bad. They're optimised for the demo.
AI builders are rewarded for the first five minutes: something visible, fast. Auth flows, migrations, quota middleware and webhook handlers don't show up in a demo, so they don't get built — and every row above is invisible until the day it's expensive. That's not a reason to skip the prototype. It's a reason to know what the prototype is.