Stacks, platforms and hosting of AI-built apps

Lovable apps had the most serious problems (62%), full-stack projects built with Cursor or Claude Code the fewest (20%). The difference follows the architecture more than the tool.

62%

of 201 Lovable, Bolt and v0 apps had a high or critical problem

57%

of 100 apps built around SaaS integrations (payments, CRM, bots)

20%

of 152 full-stack Cursor and Claude Code projects

Why browser-to-database apps score worse

Lovable, Bolt and v0 apps usually talk to the database straight from the browser, so every access rule must be right. Full-stack projects put a server in between, and the server code tends to check who is calling. Same AI, different blast radius.

What the apps connect to

Most used services: Anthropic (342), Supabase (248), OpenAI (202), PostgreSQL (151), Stripe (106), Square (65), Google Gemini (65), Redis (62), AI agent framework (52), Firebase (50). Hosting, where the repository shows it: Docker (195), Vercel (69), Cloudflare (31), Terraform (27), Kubernetes (24), Firebase Hosting (15).

By main language

TypeScript: 539 apps, 44% with a serious problem; Python: 226 apps, 52% with a serious problem; Go: 89 apps, 18% with a serious problem; Dart: 68 apps, 24% with a serious problem; JavaScript: 58 apps, 19% with a serious problem; Rust: 20 apps, 15% with a serious problem; Swift: 7 apps, 29% with a serious problem; Java: 7 apps, 29% with a serious problem; C#: 6 apps, 17% with a serious problem.

Data: Redproof's automated checks on public GitHub repositories, November 2026. No repository is named. Method and limits