Unknown
We got there, but did not prove it. The login page loaded, but nothing past it was checked. Or it never ran on mobile. Or something blocked the check entirely. Unknown does not mean probably fine.
The ship question
Is a vibe-coded app safe to put in front of real users?
Direct answer
You can know what's proven to work, what's still unknown, and what shouldn't ship. What nobody can honestly tell you is that your app is just "safe." A real launch decision is always specific: this version, these features, this situation. If nobody has tested what happens after someone logs in, that part is Unknown, and Unknown means do not ship it yet.
"Vibe coding" just describes how the app got written. It does not make your app a special case, and it is not a reason to skip asking whether it is ready. What matters is whether it works when you launch it, not how impressive the first version looked.
Language that can be true
A specific yes, not a verdict on your character
"Safe to launch" sounds like it is judging you or your app as a whole. It is not, and it should not. A useful answer sounds more like "go ahead with these three specific things, on this version of the app." An answer with no limits attached is one no honest checker should ever give. That is why our answers always take one of four shapes: Unknown, Conditional, No-Go, or a specific yes. Never a blanket "the product is fine."
No-Go
Something that matters actually failed, and we know why. The pay button does nothing. One user can see someone else's private information. Do not ship that part.
Conditional
Most things work, one specific thing does not, and we can tell you exactly what to fix next. Whether to ship is not a feeling. It comes down to what is left on that list.
A specific yes
These things work, on this version of the app, in this environment. That is not a claim about payment-industry rules, accessibility standards, or "ready for anyone, forever." The claim is exactly as big as what we actually checked, no bigger.
What's out in the open
What a stranger can see
The marketing page, the login screen, the error page, the footer. Anyone can open a published .lovable.app or .replit.app link and see these. That is genuinely worth checking, but it is the most you can prove without a test account. It is not your actual product.
What's still unknown
What stays Unknown
Anything that needs a login, a paid plan, or existing data to see. Checkout. Inviting a teammate. Whether one customer can accidentally see another customer's information. Until you give a checker a real test account, all of that stays Unknown. Treating that Unknown as probably fine is the most common way an AI-built launch goes wrong.
A security scan does not prove a customer can use your app
Lovable offers a basic and a deep scan of your code, looking for things like who can access what data and whether your database rules are safe, plus an optional outside security test against your live app. Lovable security docs. Bolt offers a security audit of "your code and database." Bolt security support. Base44 scans your whole app, including your backend.
The technical detailLovable's Deep scan is described as an agentic review of the codebase covering RLS, schema, and edge-function auth, with an optional Aikido AI pentest against the running app.
Those checks matter. But they answer a different question than "can a stranger actually finish checkout" or "can one customer open someone else's invoice." A perfectly clean security scan and a broken pay button can exist in the same app at the same time. So can a real security problem sitting next to a page that looks fine.
Our take: the fact that these companies sell a paid "is this safe" add-on tells you people want that answer. It does not mean the company that built your app is an independent judge of its own work. See who checks AI-generated code.
A decision you can make this afternoon
Name the users. Name the three journeys they must finish. Run them as described in how to test. Then pick one sentence and stop decorating it.
- If a named journey fails, the answer is No-Go for that journey. Fix it, or take it out of the launch.
- If you never tested what happens after login, the honest answer is Unknown, and you would be launching only the public-facing part. Say that plainly.
- If your three journeys all work on this version of the app, that is a specific yes for those three things. It is not a compliance certificate.
Legal liability, payment-industry rules, accessibility standards, and a complete security audit are all outside what this page covers. Anyone who claims those things based on nothing but a preview link is selling you something else entirely.
Where PeerRun comes in
We will tell you what is proven. We will not tell you it is safe.
PeerRun can try the journeys that matter on a project you bring, tell you exactly what is broken, and is allowed to say do not ship yet. We will not use the word "safe" loosely. What we call a Passport, once you have one, is a specific record of what that version of your app actually proved. It is not a badge you can show off on this page, because you do not have one yet.
What PeerRun cannot tell a launch
- Anything behind a sign-in screen stays Unknown without access.
- A robot-check is Blocked, not Broken.
- Any verdict only covers the journeys we actually proved, on a specific version of your app.
- This page is not a legal, payment-compliance, accessibility, or security-audit certificate.
- Nothing gets checked just by being on this signed-out page. There is no score here.
Clicking through only tells us you came here to bring a project.