Best Vibe Coding Tools: Pick by Job, Price and Lock-In
The best vibe coding tools: pick by job, price and lock-in
Updated
The best vibe coding tools fall into three classes, AI app builders, AI IDEs and terminal agents, and the right one depends on the job, the monthly cost and how easily you can leave. This page is Step 2 of 12 in the guide. You leave it with a short list of tools for Bookly, the plan each one needs and a lock-in check you can run on any tool.
Prices change often, so open the vendor link on each row before you buy. Cursor changed its plans on October 12, 2026, so older price lists online no longer match. This page owns the cross-tool price comparison. The Claude Code and Codex pages cover the plans of those two agents in more depth.
Related guides: Getting started with vibe coding, Planning and PRDs, Claude Code best practices, OpenAI Codex CLI.
The three classes of vibe coding tools
AI app builders, AI IDEs and terminal agents
This guide uses three terms for three kinds of tool. Each term keeps one meaning for the rest of the guide.
Browser tools that build whole apps. Lovable, Bolt, Base44, v0, Replit and Emergent are examples.
- No terminal and no local setup.
- Best for prototypes and idea tests.
- The code stays on the platform until you export it.
An editor with a built-in agent. Cursor and Devin Desktop (formerly Windsurf) are examples. GitHub Copilot and Cline work inside editors you already use.
- You work in a repo you own.
- You review each change in the editor.
- Best for an existing codebase.
A command-line agent that reads, edits and runs code in your repo. Claude Code, OpenAI Codex CLI, Aider and OpenHands are examples.
- Needs a terminal.
- Handles multi-file tasks and long runs.
- Runs your test and typecheck commands.
This guide calls any AI that writes and runs code a coding agent, such as Claude Code, Codex or the agent inside Cursor. The classes differ in where the code lives and who runs the agent. That difference decides which class fits the job.
Bookly: Bookly is a booking app for a small hair salon. Clients book a time slot and pay a deposit. The owner sees the day's bookings and can cancel or refund. Deposits, refunds and a database with per-client rules need code you own and can test. A builder alone is a weak fit for that job.
The best vibe coding tools by job
Pick the tool class by job, then price, then exit
Start with the job. Check the price of the plan that fits it. Then check how hard it is to leave.
| Job | Tool class | Example tools | Price to start | Lock-in |
|---|---|---|---|---|
| Clickable prototype with no coding | AI app builder | Lovable, Bolt | Lovable Pro: $25 per month billed monthly. Bolt Pro: $25 per month plus taxes. | Lovable code export starts at Pro. The code stays on the platform until you export it. |
| Backend app with payments and tests | AI IDE or terminal agent | Claude Code, Cursor | Claude Code Pro: $20 per month. Cursor Premium: $30 per month (4x Plus usage). | The repo is yours. The agent is a separate tool you can replace. |
| Large codebase with many files | Terminal agent | Claude Code, OpenAI Codex | Claude Code Pro: $20 per month. Codex in ChatGPT Plus: $20 per month. | Low. Both read a context file from your repo: CLAUDE.md or AGENTS.md. |
| Open source with your own model keys | Terminal agent | Aider, OpenHands | Free. You pay your model provider directly. | Low. You choose the model and keep the repo. |
| Stay in the editor you already use | AI IDE extension | GitHub Copilot, Cline | Copilot Pro: $10 per month. Cline is free for individual developers. | Copilot is a GitHub product. Cline lets you bring your own keys. |
| Mobile app | Mobile AI app builder | Vibecode, Rork | Vibecode Plus: $20 per month. Rork plans are on its site. | Check the export and App Store terms before you build. |
Lock-in is the cost of leaving. It counts the code, data and setup you lose when you switch. A builder gets a demo running fast. A repo you own gets a product that can move to another tool later.
Plan prices across the best vibe coding tools
Cross-tool price list
The entry paid plan, the next plan up and the unit each plan meters. Each row links the vendor pricing page.
| Tool | Class | Entry paid plan | Next plan up | What the plan meters | Vendor |
|---|---|---|---|---|---|
| Lovable | AI app builder | Pro: $25 per month billed monthly, or $250 billed annually | Business: $50 per month billed monthly, or $500 billed annually | Credits: 100 per month on Pro | Pricing page |
| Bolt | AI app builder | Pro: $25 per month plus taxes | Teams: $30 per member per month | Tokens: 10M per month on Pro | Pricing page |
| Base44 | AI app builder | Starter: $16 per month billed annually | Builder: $40 per month billed annually | Message credits: 100 on Starter, 250 on Builder | Pricing page |
| Replit | AI app builder | Core: $20 per month, or $18 billed annually | Pro: $100 per month, or $90 billed annually | Usage credits: $20 on Core, $100 on Pro | Pricing page |
| v0 | AI app builder | Plus: $30 per user per month | Business: $100 per user per month | Credits: $30 per user on Plus | Pricing page |
| Hostinger AI Builder | AI app builder | Premium: $2.49 per month on a 48-month promo | Unlimited: $3.49 per month on a 48-month promo | AI credits: 500 to 2,000 on promo plans | Pricing page |
| Emergent | AI app builder | Standard: $20 per month, or $17 billed annually | Pro: $200 per month, or $167 billed annually | Credits: 100 on Standard, 750 on Pro | Pricing page |
| Vibecode | Mobile AI app builder | Plus: $20 per month | Pro: $50 per month | Credits: $20 on Plus, $55 on Pro | Pricing page |
| Cursor | AI IDE | Plus: $8 per month (Grok models only) | Premium: $30 per month (4x Plus usage) | One weekly pool, shared by Cursor and Grok | Pricing page |
| Devin Desktop (formerly Windsurf) | AI IDE | Pro: $20 per month | Max: $200 per month | Allowance refreshes daily and weekly | Pricing page |
| GitHub Copilot | AI IDE extension | Pro: $10 per month, with $15 in AI credits | Pro+: $39 per month, with $70 in AI credits | AI credits: 1 credit = $0.01 | Pricing page |
| Cline | AI IDE extension | Free for individual developers | Enterprise: custom | Model usage, with your own key or the Cline provider | Pricing page |
| Claude Code | Terminal agent | Pro: $20 per month, or $17 billed annually | Max: from $100 per month (5x or 20x Pro usage) | 5-hour and weekly limits, shared with chat | Pricing page |
| OpenAI Codex | Terminal agent | Plus: $20 per month | Pro: $100 per month (also $200 and $500) | Estimated messages per 5-hour window, varies by model | Pricing page |
| Google Antigravity | AI IDE and terminal agent | Individuals: $0, with basic weekly rate limits | Google AI Pro or Ultra: higher limits | Business seats from $30 per seat per month | Pricing page |
| Aider | Terminal agent | Free and open source | Not applicable | Your model provider's tokens | Pricing page |
| OpenHands | Terminal agent | Agent Canvas: free, MIT licensed, self-hosted | Teams: $500 per month for up to 10 users | Your own LLM key, or Teams seats | Pricing page |
Prices change often. Open the vendor link before you buy, and check the billing period on the plan you pick. Annual billing lowers the monthly figure. Claude Pro billed annually, for example, costs $200 up front.
Three price traps that change the real bill
The list price is the start. These three traps change what you pay.
Lovable meters credits, Bolt meters tokens and Copilot meters AI credits at $0.01 each. The same prompt can drain one plan faster than another, so compare on your own prompts.
Hostinger promo prices start at $2.49 per month on a 48-month term. Renewal prices start at $10.99 per month. Budget for the renewal price.
Cursor moved new sign-ups to new plans on October 12, 2026. Copilot moved to usage-based billing on June 1, 2026. Read the plan page on the day you buy.
App Cost Calculator
AI app builders: plans, limits and exit terms
Lovable
A browser builder with its own backend option, Lovable Cloud, launched on September 29, 2025. Lovable raised $400M at a $13.3B valuation on August 12, 2026.
| Plan | Price | Credits |
|---|---|---|
| Free | $0 | 5 build credits per day, up to 30 per month, plus 20 Cloud credits and 4 AI credits per month |
| Pro | $25 per month billed monthly, or $250 billed annually ($21 per month) | 100 credits per month, scalable to 10,000, plus 5 daily credits |
| Business | $50 per month billed monthly, or $500 billed annually ($42 per month) | 100 to 10,000 credits per month |
| Enterprise | Custom | Custom |
At 10,000 credits per month, Pro costs $2,250 per month and Business costs $4,300 per month. Run that math before you pick the top of a credit range.
Private projects work on every plan. Code export is not on Free and starts at Pro. SSO is on Business and Enterprise only. Monthly credits expire 2 months after issue on monthly plans, and top-ups last 12 months.
Lovable added native Wiz security scanning on May 7, 2026, and pentesting with Aikido on March 24, 2026. The claim that builders skip security now needs that context. Run the built-in scan, then review the auth and data rules yourself.
Bolt
A browser builder that meters tokens. It has Free, Pro, Teams and Enterprise plans.
| Plan | Price | Tokens and limits |
|---|---|---|
| Free | $0 | 1M tokens per month and 300K per day. No rollover. 333K web requests per month and 10MB uploads. |
| Pro | $25 per month plus taxes | 10M tokens per month with no daily limit. Rollover included. 1M web requests and 100MB uploads. |
| Teams | $30 per member per month | 10M tokens per member. Each member has an allowance, not a shared pool. |
| Enterprise | Custom annual contract | Billed by consumption. |
Free gives 300K tokens per day. That fits a demo, not a full build. Pro removes the daily limit and adds rollover, so unused tokens carry over to the next month.
Base44
Acquired by Wix. Wix bought Base44 for about $80M in cash, announced on June 18, 2025, and said Base44 stays a distinct product.
| Plan | Billed annually | About, billed monthly | Message credits |
|---|---|---|---|
| Starter | $16 per month | about $20 per month | 100 |
| Builder | $40 per month | about $50 per month | 250 |
| Pro | $80 per month | about $100 per month | 500 |
| Elite | $160 per month | about $200 per month | 1,200 |
Free includes 25 message credits, 100 integration credits and up to 5 apps. Integration credits are a separate pool, with 2,000 to 50,000 on the paid plans.
Two-way GitHub sync needs the Builder plan or higher. It works in personal workspaces only, and the default branch must be named main. The pricing page says, "You own everything you build." Reviewer reports say the backend stays on the Base44 SDK. The docs do not say whether it runs without Base44's servers.
Replit
Agent 4 launched on March 11, 2026. Replit added Free Mode on August 18, 2026, and a Monitoring Agent, pen testing and Replit for Business between August and October 2026.
| Plan | Monthly | Billed annually | Credits and seats |
|---|---|---|---|
| Core | $20 | $18 per month | $20 in usage credits |
| Pro | $100 | $90 per month | $100 in credits, plus $100 toward the most powerful models. Up to 15 collaborators. |
Pro includes database rollback for up to 28 days. Enterprise adds SSO, SCIM and audit logs. The 2025 database deletion is covered in the security section below.
v0 by Vercel
v0 starts with React and Next.js.
| Plan | Price | Credits and terms |
|---|---|---|
| Free | $0 | New users get a one-time $5 in credits. Existing Free users get $5 per month. |
| Premium | $20 per month | Closed to new users. |
| Plus | $30 per user per month | $30 in credits per user. |
| Business | $100 per user per month | $30 in credits per user. Training opt-out is on by default. |
| Enterprise | Custom | Data is never used for training. |
Check project visibility on your plan before you add client work to a v0 project.
Hostinger AI Builder
Hostinger merged Horizons into AI Builder, which has two modes.
Promo prices start at $2.49 per month on a 48-month term. Renewal prices start at $10.99 per month. The AI credit allowances on the promo plans run from 500 to 2,000. The Hostinger FAQ says you can export your code and self-host it on any other platform.
Emergent
A browser builder with Standard and Pro plans, plus custom Business and Enterprise plans.
Free includes 10 monthly credits. Standard is $20 per month, or $17 billed annually, with 100 credits. Pro is $200 per month, or $167 billed annually, with 750 credits.
Firebase Studio is shutting down
Google set a retirement schedule for Firebase Studio. Projects need a move before the shutdown date.
Google announced the retirement on March 19, 2026. New workspaces and sign-ups were turned off on June 22, 2026. The service shuts down on March 22, 2027, and all remaining data is permanently deleted.
Google points to Google Antigravity for local, code-first work, and to Google AI Studio for browser prototypes. Antigravity needs Node.js 20 or higher and Firebase CLI 15.10.0 or higher. Firebase backend services, including Firestore, Authentication and App Hosting, are not affected. The migration questions are at the end of this page.
AI IDEs: Cursor, Devin Desktop and Copilot
Cursor
An AI IDE with a built-in agent. Cursor moved new sign-ups to new plans on October 12, 2026.
| New plan | Price | Usage |
|---|---|---|
| Plus | $8 per month | Grok models only |
| Premium | $30 per month | 4x Plus usage |
| Super | $100 per month | 15x Plus usage |
| Ultra | $200 per month | 50x Plus usage |
| Teams | From $30 per user per month | Per user |
| Enterprise | Custom | Custom |
New sign-ups also see a Free plan at $0. The included usage is one weekly pool, shared by Cursor and Grok models. Claude, GPT and Gemini are not in that pool on the new plans. They stay available on Premium and above, and usage beyond your allowance bills at API list price through top-ups.
Existing subscribers can stay on legacy plans, which have no announced end date: Hobby (free), Pro at $20 per month, Pro+ at $60 per month, Ultra at $200 per month, Teams Standard at $40 per user per month and Teams Premium at $120 per user per month. Moving to the new plan is optional and permanent.
SpaceX agreed on June 16, 2026 to buy Anysphere, the company behind Cursor, in an all-stock deal valued at about $60 billion. Public reports disagree on whether the deal has closed. Ownership and model access are now part of the buying decision.
Cursor holds a SOC 2 Type II attestation. With Privacy Mode on, Cursor says it will not train on your data. New team members inherit the team setting.
Devin Desktop (formerly Windsurf)
Cognition, the maker of Devin, acquired Windsurf in July 2025. Windsurf is now called Devin Desktop.
Cognition says Devin Desktop is the new name for Windsurf. The plans did not change: Free at $0, Pro at $20 per month, Max at $200 per month, and Teams at $80 per month plus $40 per month for each full seat. The usage allowance refreshes daily and weekly, and extra usage bills at API pricing. The windsurf.com address redirects to devin.ai.
GitHub Copilot
GitHub Copilot passed 20 million all-time users in July 2025.
| Plan | Price | AI credits per month |
|---|---|---|
| Free | $0 | Limited chat and agent usage |
| Pro | $10 per month | $15 ($10 base plus $5 flex) |
| Pro+ | $39 per month | $70 |
| Max | $100 per month | $200 |
All plans moved to usage-based billing on June 1, 2026. Premium requests became GitHub AI Credits at $0.01 per credit, and token use consumes them. Long agent sessions cost more than a flat-fee plan suggests.
Annual Pro and Pro+ subscribers stay on request-based pricing until their plan expires. Business and Enterprise are sold per seat. Confirm the seat price with GitHub before you buy for a team.
Cline
An extension for VS Code. Free for individual developers.
Bring your own keys or use the Cline provider. You pay only for model inference. Enterprise is custom. Cline fits when you want an agent in the editor you already use and prefer to pay your model provider directly.
Continue
Cursor acquired Continue. The open-source codebase stays available.
The Continue site says the open-source codebase remains freely available as a foundation for others. Do not pick Continue as a daily driver for new work.
Terminal agents: Claude Code, Codex and the rest
Terminal agents at a glance
These agents run in a terminal. Some also run inside an editor or a desktop app. Each card gives the one-line summary and the plan entry point.
Anthropic's terminal agent. It also runs in VS Code, Cursor, JetBrains, the desktop app and the web. It uses Opus 5.5, Sonnet 5.5, Haiku 5.5 and Fable 5.1. Pro is $20 per month. Free does not include it.
Claude Code deep diveCodex comes with ChatGPT plans. Free ($0) and Go ($8 per month) include it, and so do Plus ($20 per month) and Pro ($100, $200 or $500 per month). It has five surfaces: CLI, cloud, IDE extension, the ChatGPT desktop app and an SDK.
Codex deep diveGoogle's code-first agent, run locally. The $0 Individuals plan includes unlimited Tab completions and Command requests, with basic weekly rate limits. Google AI Pro and Ultra add limits. Business seats start at $30 per seat per month through Google Cloud.
Gemini CLI no longer serves free individual accounts or Google AI Pro and Ultra accounts. Those moved to Antigravity CLI on June 18, 2026. Gemini CLI now targets Gemini Code Assist Standard and Enterprise organizations. Older tutorials that say "use Gemini CLI free" are out of date.
An open-source terminal agent. It is free to use with your own model key. The GitHub repo shows about 49.8k stars, 13,138 commits and about 6.8M pip installs.
Now sold as Agent Canvas: free, MIT licensed and self-hosted, with your own LLM key. Teams is $500 per month for up to 10 users, with $50 per month for each extra seat.
An autonomous cloud agent. Devin Pro is $20 per month and includes Devin Cloud. Usage beyond the allowance bills at API pricing.
Deep dives: Claude Code and OpenAI Codex each have a page in this guide, with their own plans and limits. Claude Cowork covers non-code knowledge work and has its own page too: Claude Cowork. Read the page for your agent before you pick a daily driver.
Cursor vs Claude Code: which one to use for Bookly
Cursor and Claude Code side by side
Cursor is an AI IDE. Claude Code is a terminal agent. Claude Code also runs inside VS Code and Cursor, so the choice is where the agent works, not whether you use an editor.
| Factor | Cursor | Claude Code |
|---|---|---|
| How you work | An editor with a built-in agent. You review changes in the editor. | A terminal agent. You give it tasks in the terminal, or inside VS Code, Cursor, JetBrains or the desktop app. |
| Models | Grok models on Plus. Claude, GPT and Gemini on Premium and above, with extra usage at API list price. | Opus 5.5, Sonnet 5.5, Haiku 5.5 and Fable 5.1 on the Anthropic API. Claude Code also works through Amazon Bedrock, Google Cloud and Microsoft Foundry. |
| Entry plan | Plus: $8 per month (Grok models only). | Pro: $20 per month, or $17 billed annually. |
| Next plan | Premium: $30 per month (4x Plus usage). | Max: from $100 per month (5x or 20x Pro usage). |
| Usage limits | One weekly pool, shared by Cursor and Grok models. | A 5-hour window and a weekly limit, shared with chat and Cowork. Usage credits keep work going past either limit. |
| Team plans | Teams from $30 per user per month. | Team Standard: $25 per seat per month, or $20 billed annually. Team Premium: $125 per seat per month, or $100 billed annually. |
| Privacy and security | SOC 2 Type II. With Privacy Mode on, Cursor says it will not train on your data. | Deny rules hold in every permission mode. The sandbox turns on with /sandbox on macOS, Linux and WSL2. |
| Owner | SpaceX agreed on June 16, 2026 to buy Anysphere, the company behind Cursor. | Anthropic. |
The cost check: compare the bills, not the list price
Heavy use decides the cost. A plan that looks cheap can cost more once the limits are hit.
Anthropic's cost docs report about $13 per developer per active day. For 90% of users, spend stays under $30 per active day. Across enterprise deployments, the docs report $150 to $250 per developer per month.
Claude Code draws from the 5-hour and weekly limits of your plan. When a limit runs out, usage credits on Pro and Max let you keep working. In Cursor, usage beyond your allowance bills at API list price through top-ups. A heavy Claude user should price both bills before buying.
Use the monthly list price as a floor, not a budget. Track the first two weeks of real use on the plan you pick, then decide whether to stay, move up or switch.
Start Bookly with Claude Code on Pro at $20 per month. Bookly's hard parts are the deposit flow, the rule that a client sees only their own bookings, and the test for double booking. Those tasks need a terminal agent that runs your test commands in a repo you own. If your weekly limit runs out, move to Max from $100 per month.
Keep Cursor if you want to review each change in an editor. On the new plans, Premium at $30 per month is the first plan that keeps Claude models available. Plus runs Grok models only, so it does not fit a Claude-first Bookly build.
Lovable vs Bolt: credits vs tokens, export and cost
Lovable vs Bolt on the plans that decide the first month
Both paid entry plans cost $25 per month. The meters differ, and so does the export rule.
| Feature | Lovable | Bolt |
|---|---|---|
| Pro plan | $25 per month billed monthly, or $250 billed annually | $25 per month plus taxes |
| Monthly allowance on Pro | 100 credits, plus 5 daily credits | 10M tokens, with no daily limit |
| Rollover | Unused monthly credits expire 2 months after issue | Rollover included on paid plans, not on Free |
| Free plan | 5 credits per day, up to 30 per month. No code export. | 1M tokens per month and 300K per day. No rollover. |
| Code export and GitHub | Code export starts at Pro. GitHub sync is on every plan. | Connects to GitHub. Check the export terms before you build. |
| Training default | Business and Enterprise exclude workspace data by default | Read the current terms before you add real customer data. |
Lovable meters credits and Bolt meters tokens, so the same prompt uses a different share of each plan. Compare the two on your own prompts before you commit. Both connect to GitHub. Test the export on a small project before you build on either one.
Lovable also has native security scanning, built on Wiz. It launched on May 7, 2026.
Bookly: Lovable Free can produce a first screen, but it cannot export the code. If the first screen is the start of the real app, use Lovable Pro so the repo can leave the platform.
Export, training and hidden costs
Export and lock-in: test the exit before you build
A builder project is only as portable as its export. Test the export on a small project first.
| Platform | What leaves the platform | Details |
|---|---|---|
| Lovable | Code export starts at Pro | GitHub sync works on every plan. Private projects work on every plan. Code export is not on Free. |
| Bolt | GitHub connection | Bolt connects to GitHub. Check the current terms for export rights before you build a real product on it. |
| Base44 | Builder plan and above, for two-way sync | Two-way GitHub sync is automatic, works in personal workspaces only, and needs the default branch named main. The pricing page states that you own everything you build. |
| Hostinger AI Builder | Export and self-host | The Hostinger FAQ says you can export your code and self-host it on any other platform. |
| v0 | Confirm before you build | Export a small component and run it on your machine before you rely on v0 for a full app. |
Export a small test project, clone it, and run it on your own machine. If the export fails there, you learn the lock-in before you pay for more features. Run the same test on Bookly's first screen. The git steps for the clone are on the workflow page.
Who uses your code for training
Training settings differ by plan and by vendor. Set them before you paste any client code or real customer data.
| Platform | Default or setting | What it means |
|---|---|---|
| Lovable | Free and Pro users opt out per account | Business and Enterprise exclude workspace data from training by default. |
| Cursor | Privacy Mode decides | With Privacy Mode on, Cursor says it will not train on your data. New team members inherit the team setting. |
| v0 | Business: training opt-out on by default | Enterprise: data is never used for training. |
| Bolt | Read the current terms | Check the terms before you add real customer data. |
| Replit | Enterprise: SSO, SCIM and audit logs | Read the current terms for training use before you connect a production database. |
Claude Code is not on the Free plan. On a paid Claude plan, read the current Anthropic terms before you send client code.
Free tiers and the traps they hide
A free plan runs out fast on a real app. Know the limit before the first build.
5 credits per day, up to 30 per month. Private projects work. Code export is not on Free, and daily credits do not roll over.
1M tokens per month and 300K per day. No rollover on Free. The daily cap fits a demo, not a full build.
25 message credits, 100 integration credits and up to 5 apps. Two-way GitHub sync needs the Builder plan.
New users get a one-time $5 in credits. Existing Free users get $5 per month.
Hidden costs: the host and payments bill
The builder is rarely the only bill. Hosting and payments add their own plans and fees.
Free is $0 with 2 active projects. A project pauses after 1 week of inactivity. Pro starts at $25 per month, with a spend cap on by default. Team starts at $599 per month.
Hobby is $0 and is for personal, non-commercial use only. Pro is $20 per month with $20 of included credit.
2.9% plus 30 cents per successful domestic card transaction.
Bookly example: on a hypothetical $20 deposit, the card fee is $0.88. That is 2.9% of $20, which is $0.58, plus $0.30. Keep the Stripe secret key on the server. The security page covers payment keys. Hosting, monitoring and spend caps are on the deployment page.
Security: what these tools have been caught doing
Incidents and disclosures, in short
Each item states the fact. Secrets, auth and row-level security have their own page, linked at the end.
Wiz reported that two Base44 endpoints let anyone with a public app ID register an account on that app. Wix fixed the flaw within 24 hours and reported no evidence of customer impact.
Replit's agent deleted a production database during a code freeze. Step 4 covers what happened and the rollback habits that prevent it.
Escape.tech's scan of 5,600+ vibe-coded apps found exposed secrets and personal data in apps built with these tools. Step 6 has the full numbers and the fixes.
Cursor versions below 1.3.9 are affected. Version 1.3.9 fixes the issue. The CVSS score is 9.8.
Claude Code versions before 1.0.4 could leak file contents through DNS requests. Version 1.0.4 fixes it. Versions before 1.0.24 are forced to update.
Shai-Hulud npm worm variants installed fake MCP servers whose tool descriptions tell the agent to collect SSH keys, cloud credentials and API keys. On April 23, 2026, a backdoored @bitwarden/cli release read ~/.claude.json and ~/.claude/mcp.json.
Georgia Tech's Vibe Security Radar has traced about 74 CVEs to AI coding tools. Monthly counts were 6 in January, 15 in February and 35 in March 2026. Claude Code accounts for 27 cases, partly because it leaves identifiable signatures. The lead researcher says the true number is higher.
IEEE Spectrum reported in January 2026 that newer models "often generate code that fails to perform as intended, but which on the surface seems to run successfully." Read AI-written code and run your own checks. Vendor scans do not replace that review.
Secrets, auth and Supabase row-level security are on the security page. The common questions at the end of this page cover the MCP risk in more depth.
Mobile tools and when to leave a builder
Mobile vibe coding tools
Two builders target phone apps. Check the App Store terms before you promise a release date.
Rork builds iOS apps and handles App Store publishing, according to its site. Plan names and prices are on rork.com.
Plus is $20 per month with $20 in credits. Pro is $50 per month with $55 in credits. Max is $200 per month with $220 in credits. The first app build is free. Paid plans include a database, auth, App Store submission, source download and SSH access to Cursor. Vibecode uses Anthropic, OpenAI and Google models.
Lovable launched its own mobile app on April 27, 2026. That app lets you use Lovable on a phone. It does not show that Lovable outputs native apps. Store rules and release steps are on the deployment page.
Leave a builder when it becomes the bottleneck
Move when the builder slows the work, not on a fixed date. These signs mean the move is due.
- You spend more time working around platform limits than building features.
- You need custom backend logic that the builder does not support.
- You need an integration that the platform does not offer.
- You need tests and a review step before each change ships.
- 1.Export the project to a repo.
- 2.Clone the repo and run it on your own machine.
- 3.Add the first test before you add a feature. The TDD page shows the method.
For Bookly, the move comes when the deposit flow needs backend code that the builder cannot run. Branches and commits for that move are on the workflow page.
Custom code, no-code and the stack
Some work does not need a coding agent at all.
- Use no-code tools for connections and one-off jobs, such as a batch email or a one-time data export.
- Write custom code for the core product, complex logic and anything that moves money.
Stack choice belongs on the architecture page. SaaS boilerplate prices (ShipFast, Supastarter) are in the cost calculator above. Chat assistants write code snippets in a chat window. This guide covers tools that work on your repo.
Page 3 turns Bookly into a product requirements document. It covers the data model for clients, staff, services, bookings and payments, and an acceptance check for each feature. Continue to Planning and PRDs.
Common Questions
Which AI is best for coding?
There is no single best one; it depends on the job. AI app builders such as Lovable and Bolt are fastest for a first prototype in the browser. AI IDEs such as Cursor suit people who want to read and edit the code. Terminal agents such as Claude Code and Codex suit larger changes, tests and scripts. Pick by job and budget, then by how easily you can leave with your code.
Claude Code vs Cursor: which should I use?
Cursor is an editor with an agent inside; Claude Code is an agent that runs in your terminal, IDE or desktop app. Since October 12, 2026, new Cursor sign-ups get the X Subscription: Plus at $8 a month uses Grok models only, and Claude, GPT and Gemini usage is billed at API rates from Premium up. Claude Pro at $20 a month includes Claude Code with plan limits.
GitHub Copilot vs Claude Code: what is the difference in cost?
GitHub Copilot moved to usage-based AI Credits on June 1, 2026, with Pro at $10 a month and a Max plan at $100. Claude Code comes with Claude plans: Pro at $20 a month ($17 billed annually) and Max from $100 a month, with 5-hour and weekly limits shared with chat. Copilot fits teams already in GitHub; Claude Code fits larger agent-driven changes.
Lovable vs Bolt: which is cheaper?
Both Pro plans start at $25 a month, but they meter differently. Lovable Pro includes 100 credits a month plus 5 a day, and Bolt Pro includes 10M tokens a month with rollover. Credits and tokens do not convert, so the same app can cost more on either one. Build one small feature on each free plan and compare what it used before you pay.
Is Firebase Studio shutting down, and what should I move to?
New Firebase Studio workspaces were turned off on June 22, 2026. The service shuts down on March 22, 2027, and all remaining data is permanently deleted. For local, agent-driven work, move to Google Antigravity, which needs Node.js 20 or higher and Firebase CLI 15.10.0 or higher. For browser prototypes, use Google AI Studio. Firestore, Authentication and App Hosting are not affected.
Which AI app builders let you export your code?
Lovable syncs to GitHub on every plan, but code export starts at Pro. Base44 needs the Builder plan or higher for two-way GitHub sync, and reviewer reports say its backend stays on the Base44 SDK. Bolt also connects to GitHub. Whatever the builder, clone the exported repo and run it on your own machine before you build more on it.