Who verifies AI-generated code today?

v0 is built from a few different AI systems working together: one that writes the code, and a separate one whose only job is to catch and fix common code mistakes as it goes. Vercel licenses its core AI model rather than building it from scratch. v0 composite model family, 1 June 2025.

The technical detailVercel's own deep dive states the v0 model family "combine[s] specialized knowledge from retrieval-augmented generation (RAG), reasoning from state-of-the-art large language models (LLMs), and error fixing from a custom streaming post-processing model." The base model is rented: v0-1.0-md used Anthropic Sonnet 3.7; v0-1.5-md used Sonnet 4. A trained AutoFix model, vercel-autofixer-01, streams alongside generation to repair common code errors.

v0 does have a browser feature, but Vercel's own docs describe it as looking at other websites for visual reference, not as testing your app. agentic features. We found no claim anywhere that v0 actually clicks through your app before showing it to you. That is why that cell says Unknown.

Lovable builds a complete working app for you, front end, backend, database, and login, all included. introduction. If a build or publish fails, it shows a banner offering to try fixing it automatically. publish troubleshooting.

Security checking is a separate, paid feature: a basic and a deep scan of your code, plus an optional outside security test against your live app. security. That is a real check, but it is a security review, not someone clicking through your app to see if it works. And it is still Lovable checking Lovable's own projects, not an outside judge.

Bolt's editor preview runs entirely inside your own browser tab, using technology that simulates a server without being one. It runs because that is simply how the editor works, not because anything is checking or verifying it. webcontainers.io

The technical detailOfficial docs describe WebContainers as "a browser-based runtime for executing Node.js applications and operating system commands, entirely inside your browser tab."

Bolt offers a security audit of your code and database as a separate feature. support. We found no evidence of any feature that actually clicks through the app to test it. Some of Bolt's own limits pages were not reachable when we did this research, so we mark those as Unknown rather than guess, except where the underlying WebContainer technology is explicit about its own limits (it only runs JavaScript and Node, and everything happens on your device).

This is the one that deserves real credit. Replit's own launch post says Agent 3 "tests the apps it builds (using an actual browser)… checks buttons, forms, APIs, data sources etc, ensuring every part of your app works perfectly," then replies with a summary and fixes anything it found. launch blog. Their testing docs describe it navigating the app like a real visitor would, including logging in, plus recording video of what it did. app testing.

Our take: the same AI decides what to test, judges whether it passed, and fixes what it finds. There is no record of a failing result that anyone outside Replit could independently check, and nothing signed or verifiable comes out of it. Replit deserves credit for building real browser testing into the product. That is also exactly why it is self-grading: the tester and the thing being tested are the same AI.

Base44 gives you a manual testing checklist and a button to view your app as a regular user would see it. quick start. Their chat assistant can help you test if you ask it to. There is also a security scan that covers your whole app, including the backend. security scan. We found no evidence of anything that automatically clicks through your app on its own. Base44 knows someone needs to check the app, and that someone is you.

Cursor does not host or run your app the way Lovable or v0 do. Its Bugbot feature reviews the code changes you are about to merge, never an actual link. Bugbot docs. There is a browser tool that can visit web pages, but Cursor's own docs do not describe it as a testing feature. A Cursor review tells you about the code change itself. It does not tell you whether checkout still works.

An earlier version of our research marked Hercules as Unknown because there was not much public detail. Current docs are clearer, so we use those. Their Browser Tests run as one of three identities: a Hercules test account that never touches real data, your own session, or a logged-out visitor. Those tests only see what is visible on screen and cannot test anything behind a login. browser-tests. A separate Audits feature checks the backend. audits.

The technical detailAudits confirm "every backend function enforces authorization, ownership checks."

The split between the two checks is worth noticing, but it is still the same company grading the app it built and hosts. It is not an outside opinion.