Same-Prompt Test of Four AI App Builders: Three Perfect Scores, Problems Hidden in the Details

A Head-to-Head Review With No 'Best'

The market is flooded with 'best AI app builder' lists, yet they rarely offer reproducible evidence. VibeTierList did something simple that few platforms are willing to do: it used the exact same prompt to build the same project on the free tiers of four tools, and made the inspection process public.

The four tools tested were Lovable, Bolt, Base44, and v0. There was only one prompt: build a multi-user to-do app with sign-up/login, database isolation (each user can only see their own tasks), and a publicly accessible URL.

The reviewer then used Playwright to run 10 automated functional checks, one mobile-width adaptation check, and one cross-user permission test—whether test user B could see user A's to-dos. The test was run only once, with each tool generating only once.

Vibe coding / AI app builders: These tools let users generate runnable full-stack apps directly from natural language prompts. Behind the scenes, a large model typically handles generation of the frontend code, backend logic, and database schema, and automatically deploys to the cloud. Lovable, Bolt, Base44, and v0 all fall into this category, but they take different routes: Bolt and v0 lean developer-oriented, tending to hand code and configuration back to the user; Lovable and Base44 lean more toward a hosted 'go live in one sentence' experience. Understanding this difference is key, because it directly explains why v0 later requires manually installing Neon (hosted Postgres), approving SQL migrations, and generating an auth secret—these are exactly the control points that developer-oriented tools deliberately retain.

Scoreboard: Three Perfect Scores, One Close

Tool	Score	Prompt to Live	Fix-Prompt Count	Free-Tier Consumption
Lovable	100	Under 4 minutes	0	2.10 credits
Bolt	100	About 6 minutes	0	About 101K / 1M monthly tokens
Base44	100	About 3.5 minutes	0	1 of 25 message quota
v0	95	About 15 minutes	0	$3.81 of a one-time $5 credit

None of the four tools showed data leakage: user B did not see user A's to-dos in any of the apps. That deserves credit, since database isolation is the core security baseline for this kind of app.

But the three 100 scores actually expose the limitations of the test itself. As the author says, tied perfect scores mean the test was too simple.

Multi-user data isolation and token revocation: A to-do app looks simple, but satisfying 'each user can only see their own tasks' requires implementing row-level permissions at the database layer (such as Postgres Row Level Security) or enforcing user-ID-filtered queries on the server side. Hiding the UI on the frontend alone does not count as isolation. The cross-user permission test in the article is exactly what verifies this. 'Logout does not revoke the server-side token' is another class of problem: most implementations use JWT, and the token remains valid until it expires. If logout only clears client-side storage without blacklisting the token server-side or shortening its validity, a stolen token can still be used to access the app. This is a real security risk that automated functional checks can hardly cover.

The Problems Lie Outside the Perfect Scores

The truly valuable information is not in the scores, but in the details that automated checks did not cover.

Bolt: Buttons That Only Exist on Mouse Hover

The interface generated by Bolt has a problem on mobile: the edit and delete buttons only appear on mouse hover. Touch-screen users have no 'hover' action, so they cannot see these two buttons at all. It is not hard to fix, but you only find it by testing on a real device—everything looks fine in a desktop browser.

Base44: The Fastest One Is Also the Easiest to Get Stuck In

Base44 took about 3.5 minutes, the fastest of the four. But it has a dead corner in user experience: if a new user closes the email verification code page, the login screen offers no entry point to return to that page or resend the code. In addition, logout does not revoke the token on the server side, which is an easily overlooked security risk.

v0: Not Broken, but the Barrier Is Elsewhere

v0 has no obvious functional defects and scored 95. The problem is the onboarding cost: the whole flow took about 15 minutes and required 6 manual steps—accept terms, install Neon, approve SQL twice, generate an auth secret, and publish manually. For developers this is nothing, but for non-technical users it is a wall. It also consumed $3.81 of the one-time $5 credit, meaning the free tier is only enough for roughly one app of this scale.

Playwright and the blind spot of hover-state testing: Playwright is a mainstream browser automation testing framework that can drive Chromium, Firefox, and WebKit to perform clicks, form filling, screenshots, and other operations. The 10 functional checks and mobile-width adaptation check in the article were completed with it. But Playwright simulates a desktop mouse environment by default and can trigger hover events, so buttons that 'only appear on hover' behave normally in automation, which actually masks the problem that touch-screen users cannot see the buttons. To find this kind of defect, you need to set up mobile device emulation, interact via touch, or manually verify on a real device—which also explains why the reviewers later built a separate tool specifically for checking apps at phone size.

Lovable: The Cleanest Answer Sheet

Lovable's checks found no functional defects. The only nitpick is that the minimum password length is 6 characters, which is a bit lax.

Three Lessons From the Actual Test

A perfect score is a signal that the test is too simple, not proof that the tool is too strong. Three 100 scores provide almost no differentiation. The reviewers have already published the v2 prompt, checks, and scoring rules (results not yet released). v2 adds more complex requirements such as roles, invitations, search, and share links, and will most likely create separation.

Failure details are the basis for decisions. Demo videos will never show buttons that only trigger on hover, login loops that go nowhere, or cumbersome setup friction. Yet these are exactly the problems real users hit on day one.

Free-tier headroom varies enormously. The same app consumed 4% of the monthly quota on one tool and most of a one-time credit on another. If you plan to build several prototypes on the free tier, this difference will directly determine your choice.

From Review to Tool: Scan my app

These missed bugs led VibeTierList to build a derivative tool—Scan my app (free beta). After entering your own app's URL and verifying ownership, an agent will click up to 5 pages (without sending write requests), enter garbage data into forms, check the app at phone size, and finally send you a report with screenshots.

To be clear, this is a best-effort QA check, not a security audit. It can help you find issues like hover buttons and dead-end login pages, but it cannot replace a professional security assessment.

The Boundaries of This Test

The reviewers themselves listed the limitations: each tool was run only once, the app was simple, and the free-tier status is as of mid-October 2026. Full screenshots and process records are published on their website.

Conclusions from a single run should be treated with caution—large-model app generation has a degree of randomness, and the same prompt may produce different results across runs. The complexity of the v2 test and multiple runs may fill this gap. But until then, this test at least proves one thing: in the AI app builder race, the gap between 'works' and 'works well' is often hidden in those few buttons that nobody actively clicks.

One-line Summary

Same-prompt test of four AI app builders: three perfect scores reveal the test was too simple, and the differences lie in the details.

Paragraph Summary

VibeTierList used the same prompt to generate a multi-user to-do app on the free tiers of Lovable, Bolt, Base44, and v0, and ran functional checks, mobile adaptation, and cross-user permission tests via Playwright. Three tools scored 100 and v0 scored 95, with no data leakage in any of them. But the author points out that the three perfect scores actually show the test was too simple, and the real decision-making information lies in details automation did not cover: Bolt's edit and delete buttons only appear on hover and are unusable on touch screens; Base44's login page cannot resend verification codes and logout does not revoke the server-side token; v0 requires 6 manual steps and consumes most of a one-time credit. Free-tier headroom also differs enormously. The reviewers therefore launched a free beta tool, Scan my app, and candidly acknowledge the limitations of a single run and a simple app.