Skip to content
GrowthVector.io

Best Vibe Coding Tools: Pick by Job, Price and Lock-In

The best vibe coding tools: pick by job, price and lock-in

Updated

The best vibe coding tools fall into three classes, AI app builders, AI IDEs and terminal agents, and the right one depends on the job, the monthly cost and how easily you can leave. This page is Step 2 of 12 in the guide. You leave it with a short list of tools for Bookly, the plan each one needs and a lock-in check you can run on any tool.

Prices change often, so open the vendor link on each row before you buy. Cursor changed its plans on October 12, 2026, so older price lists online no longer match. This page owns the cross-tool price comparison. The Claude Code and Codex pages cover the plans of those two agents in more depth.

Related guides: Getting started with vibe coding, Planning and PRDs, Claude Code best practices, OpenAI Codex CLI.

The three classes of vibe coding tools

AI app builders, AI IDEs and terminal agents

This guide uses three terms for three kinds of tool. Each term keeps one meaning for the rest of the guide.

AI app builder

Browser tools that build whole apps. Lovable, Bolt, Base44, v0, Replit and Emergent are examples.

  • No terminal and no local setup.
  • Best for prototypes and idea tests.
  • The code stays on the platform until you export it.
AI IDE

An editor with a built-in agent. Cursor and Devin Desktop (formerly Windsurf) are examples. GitHub Copilot and Cline work inside editors you already use.

  • You work in a repo you own.
  • You review each change in the editor.
  • Best for an existing codebase.
Terminal agent

A command-line agent that reads, edits and runs code in your repo. Claude Code, OpenAI Codex CLI, Aider and OpenHands are examples.

  • Needs a terminal.
  • Handles multi-file tasks and long runs.
  • Runs your test and typecheck commands.

This guide calls any AI that writes and runs code a coding agent, such as Claude Code, Codex or the agent inside Cursor. The classes differ in where the code lives and who runs the agent. That difference decides which class fits the job.

Bookly: Bookly is a booking app for a small hair salon. Clients book a time slot and pay a deposit. The owner sees the day's bookings and can cancel or refund. Deposits, refunds and a database with per-client rules need code you own and can test. A builder alone is a weak fit for that job.

The best vibe coding tools by job

Pick the tool class by job, then price, then exit

Start with the job. Check the price of the plan that fits it. Then check how hard it is to leave.

JobTool classExample toolsPrice to startLock-in
Clickable prototype with no codingAI app builderLovable, BoltLovable Pro: $25 per month billed monthly. Bolt Pro: $25 per month plus taxes.Lovable code export starts at Pro. The code stays on the platform until you export it.
Backend app with payments and testsAI IDE or terminal agentClaude Code, CursorClaude Code Pro: $20 per month. Cursor Premium: $30 per month (4x Plus usage).The repo is yours. The agent is a separate tool you can replace.
Large codebase with many filesTerminal agentClaude Code, OpenAI CodexClaude Code Pro: $20 per month. Codex in ChatGPT Plus: $20 per month.Low. Both read a context file from your repo: CLAUDE.md or AGENTS.md.
Open source with your own model keysTerminal agentAider, OpenHandsFree. You pay your model provider directly.Low. You choose the model and keep the repo.
Stay in the editor you already useAI IDE extensionGitHub Copilot, ClineCopilot Pro: $10 per month. Cline is free for individual developers.Copilot is a GitHub product. Cline lets you bring your own keys.
Mobile appMobile AI app builderVibecode, RorkVibecode Plus: $20 per month. Rork plans are on its site.Check the export and App Store terms before you build.

Lock-in is the cost of leaving. It counts the code, data and setup you lose when you switch. A builder gets a demo running fast. A repo you own gets a product that can move to another tool later.

Plan prices across the best vibe coding tools

Cross-tool price list

The entry paid plan, the next plan up and the unit each plan meters. Each row links the vendor pricing page.

ToolClassEntry paid planNext plan upWhat the plan metersVendor
LovableAI app builderPro: $25 per month billed monthly, or $250 billed annuallyBusiness: $50 per month billed monthly, or $500 billed annuallyCredits: 100 per month on ProPricing page
BoltAI app builderPro: $25 per month plus taxesTeams: $30 per member per monthTokens: 10M per month on ProPricing page
Base44AI app builderStarter: $16 per month billed annuallyBuilder: $40 per month billed annuallyMessage credits: 100 on Starter, 250 on BuilderPricing page
ReplitAI app builderCore: $20 per month, or $18 billed annuallyPro: $100 per month, or $90 billed annuallyUsage credits: $20 on Core, $100 on ProPricing page
v0AI app builderPlus: $30 per user per monthBusiness: $100 per user per monthCredits: $30 per user on PlusPricing page
Hostinger AI BuilderAI app builderPremium: $2.49 per month on a 48-month promoUnlimited: $3.49 per month on a 48-month promoAI credits: 500 to 2,000 on promo plansPricing page
EmergentAI app builderStandard: $20 per month, or $17 billed annuallyPro: $200 per month, or $167 billed annuallyCredits: 100 on Standard, 750 on ProPricing page
VibecodeMobile AI app builderPlus: $20 per monthPro: $50 per monthCredits: $20 on Plus, $55 on ProPricing page
CursorAI IDEPlus: $8 per month (Grok models only)Premium: $30 per month (4x Plus usage)One weekly pool, shared by Cursor and GrokPricing page
Devin Desktop (formerly Windsurf)AI IDEPro: $20 per monthMax: $200 per monthAllowance refreshes daily and weeklyPricing page
GitHub CopilotAI IDE extensionPro: $10 per month, with $15 in AI creditsPro+: $39 per month, with $70 in AI creditsAI credits: 1 credit = $0.01Pricing page
ClineAI IDE extensionFree for individual developersEnterprise: customModel usage, with your own key or the Cline providerPricing page
Claude CodeTerminal agentPro: $20 per month, or $17 billed annuallyMax: from $100 per month (5x or 20x Pro usage)5-hour and weekly limits, shared with chatPricing page
OpenAI CodexTerminal agentPlus: $20 per monthPro: $100 per month (also $200 and $500)Estimated messages per 5-hour window, varies by modelPricing page
Google AntigravityAI IDE and terminal agentIndividuals: $0, with basic weekly rate limitsGoogle AI Pro or Ultra: higher limitsBusiness seats from $30 per seat per monthPricing page
AiderTerminal agentFree and open sourceNot applicableYour model provider's tokensPricing page
OpenHandsTerminal agentAgent Canvas: free, MIT licensed, self-hostedTeams: $500 per month for up to 10 usersYour own LLM key, or Teams seatsPricing page

Prices change often. Open the vendor link before you buy, and check the billing period on the plan you pick. Annual billing lowers the monthly figure. Claude Pro billed annually, for example, costs $200 up front.

Three price traps that change the real bill

The list price is the start. These three traps change what you pay.

Usage units differ

Lovable meters credits, Bolt meters tokens and Copilot meters AI credits at $0.01 each. The same prompt can drain one plan faster than another, so compare on your own prompts.

Promo prices renew higher

Hostinger promo prices start at $2.49 per month on a 48-month term. Renewal prices start at $10.99 per month. Budget for the renewal price.

Plans change mid-year

Cursor moved new sign-ups to new plans on October 12, 2026. Copilot moved to usage-based billing on June 1, 2026. Read the plan page on the day you buy.

Tool

App Cost Calculator

Step 1 of 10:AI App Builder
$0/mo
Lovable

New apps use TanStack Start (React + Vite before May 13, 2026) with Supabase. Most popular for non-technical MVPs.

Bolt.new

Built on StackBlitz WebContainers. Meters usage in tokens.

Base44

Acquired by Wix. Most beginner-friendly all-in-one platform.

Replit

Browser IDE with an autonomous agent that writes and runs code.

v0 by Vercel

React + Tailwind + shadcn/ui. Clean code output.

Hostinger AI Builder

Hostinger Horizons is now the AI Builder. Hosting included. Promo prices run 48 months.

Emergent

Multi-agent system for web and mobile apps.

AI app builders: plans, limits and exit terms

Lovable

A browser builder with its own backend option, Lovable Cloud, launched on September 29, 2025. Lovable raised $400M at a $13.3B valuation on August 12, 2026.

PlanPriceCredits
Free$05 build credits per day, up to 30 per month, plus 20 Cloud credits and 4 AI credits per month
Pro$25 per month billed monthly, or $250 billed annually ($21 per month)100 credits per month, scalable to 10,000, plus 5 daily credits
Business$50 per month billed monthly, or $500 billed annually ($42 per month)100 to 10,000 credits per month
EnterpriseCustomCustom

At 10,000 credits per month, Pro costs $2,250 per month and Business costs $4,300 per month. Run that math before you pick the top of a credit range.

Private projects work on every plan. Code export is not on Free and starts at Pro. SSO is on Business and Enterprise only. Monthly credits expire 2 months after issue on monthly plans, and top-ups last 12 months.

Security scanning is now built in

Lovable added native Wiz security scanning on May 7, 2026, and pentesting with Aikido on March 24, 2026. The claim that builders skip security now needs that context. Run the built-in scan, then review the auth and data rules yourself.

Bolt

A browser builder that meters tokens. It has Free, Pro, Teams and Enterprise plans.

PlanPriceTokens and limits
Free$01M tokens per month and 300K per day. No rollover. 333K web requests per month and 10MB uploads.
Pro$25 per month plus taxes10M tokens per month with no daily limit. Rollover included. 1M web requests and 100MB uploads.
Teams$30 per member per month10M tokens per member. Each member has an allowance, not a shared pool.
EnterpriseCustom annual contractBilled by consumption.

Free gives 300K tokens per day. That fits a demo, not a full build. Pro removes the daily limit and adds rollover, so unused tokens carry over to the next month.

Base44

Acquired by Wix. Wix bought Base44 for about $80M in cash, announced on June 18, 2025, and said Base44 stays a distinct product.

PlanBilled annuallyAbout, billed monthlyMessage credits
Starter$16 per monthabout $20 per month100
Builder$40 per monthabout $50 per month250
Pro$80 per monthabout $100 per month500
Elite$160 per monthabout $200 per month1,200

Free includes 25 message credits, 100 integration credits and up to 5 apps. Integration credits are a separate pool, with 2,000 to 50,000 on the paid plans.

Two-way GitHub sync needs the Builder plan or higher. It works in personal workspaces only, and the default branch must be named main. The pricing page says, "You own everything you build." Reviewer reports say the backend stays on the Base44 SDK. The docs do not say whether it runs without Base44's servers.

Replit

Agent 4 launched on March 11, 2026. Replit added Free Mode on August 18, 2026, and a Monitoring Agent, pen testing and Replit for Business between August and October 2026.

PlanMonthlyBilled annuallyCredits and seats
Core$20$18 per month$20 in usage credits
Pro$100$90 per month$100 in credits, plus $100 toward the most powerful models. Up to 15 collaborators.

Pro includes database rollback for up to 28 days. Enterprise adds SSO, SCIM and audit logs. The 2025 database deletion is covered in the security section below.

v0 by Vercel

v0 starts with React and Next.js.

PlanPriceCredits and terms
Free$0New users get a one-time $5 in credits. Existing Free users get $5 per month.
Premium$20 per monthClosed to new users.
Plus$30 per user per month$30 in credits per user.
Business$100 per user per month$30 in credits per user. Training opt-out is on by default.
EnterpriseCustomData is never used for training.

Check project visibility on your plan before you add client work to a v0 project.

Hostinger AI Builder

Hostinger merged Horizons into AI Builder, which has two modes.

Promo prices start at $2.49 per month on a 48-month term. Renewal prices start at $10.99 per month. The AI credit allowances on the promo plans run from 500 to 2,000. The Hostinger FAQ says you can export your code and self-host it on any other platform.

Emergent

A browser builder with Standard and Pro plans, plus custom Business and Enterprise plans.

Free includes 10 monthly credits. Standard is $20 per month, or $17 billed annually, with 100 credits. Pro is $200 per month, or $167 billed annually, with 750 credits.

Firebase Studio is shutting down

Google set a retirement schedule for Firebase Studio. Projects need a move before the shutdown date.

Shutdown: March 22, 2027
Key dates

Google announced the retirement on March 19, 2026. New workspaces and sign-ups were turned off on June 22, 2026. The service shuts down on March 22, 2027, and all remaining data is permanently deleted.

Google points to Google Antigravity for local, code-first work, and to Google AI Studio for browser prototypes. Antigravity needs Node.js 20 or higher and Firebase CLI 15.10.0 or higher. Firebase backend services, including Firestore, Authentication and App Hosting, are not affected. The migration questions are at the end of this page.

AI IDEs: Cursor, Devin Desktop and Copilot

Cursor

An AI IDE with a built-in agent. Cursor moved new sign-ups to new plans on October 12, 2026.

New planPriceUsage
Plus$8 per monthGrok models only
Premium$30 per month4x Plus usage
Super$100 per month15x Plus usage
Ultra$200 per month50x Plus usage
TeamsFrom $30 per user per monthPer user
EnterpriseCustomCustom

New sign-ups also see a Free plan at $0. The included usage is one weekly pool, shared by Cursor and Grok models. Claude, GPT and Gemini are not in that pool on the new plans. They stay available on Premium and above, and usage beyond your allowance bills at API list price through top-ups.

Existing subscribers can stay on legacy plans, which have no announced end date: Hobby (free), Pro at $20 per month, Pro+ at $60 per month, Ultra at $200 per month, Teams Standard at $40 per user per month and Teams Premium at $120 per user per month. Moving to the new plan is optional and permanent.

SpaceX agreed on June 16, 2026 to buy Anysphere, the company behind Cursor, in an all-stock deal valued at about $60 billion. Public reports disagree on whether the deal has closed. Ownership and model access are now part of the buying decision.

Cursor holds a SOC 2 Type II attestation. With Privacy Mode on, Cursor says it will not train on your data. New team members inherit the team setting.

Devin Desktop (formerly Windsurf)

Cognition, the maker of Devin, acquired Windsurf in July 2025. Windsurf is now called Devin Desktop.

Cognition says Devin Desktop is the new name for Windsurf. The plans did not change: Free at $0, Pro at $20 per month, Max at $200 per month, and Teams at $80 per month plus $40 per month for each full seat. The usage allowance refreshes daily and weekly, and extra usage bills at API pricing. The windsurf.com address redirects to devin.ai.

GitHub Copilot

GitHub Copilot passed 20 million all-time users in July 2025.

PlanPriceAI credits per month
Free$0Limited chat and agent usage
Pro$10 per month$15 ($10 base plus $5 flex)
Pro+$39 per month$70
Max$100 per month$200

All plans moved to usage-based billing on June 1, 2026. Premium requests became GitHub AI Credits at $0.01 per credit, and token use consumes them. Long agent sessions cost more than a flat-fee plan suggests.

Annual Pro and Pro+ subscribers stay on request-based pricing until their plan expires. Business and Enterprise are sold per seat. Confirm the seat price with GitHub before you buy for a team.

Cline

An extension for VS Code. Free for individual developers.

Bring your own keys or use the Cline provider. You pay only for model inference. Enterprise is custom. Cline fits when you want an agent in the editor you already use and prefer to pay your model provider directly.

Continue

Cursor acquired Continue. The open-source codebase stays available.

The Continue site says the open-source codebase remains freely available as a foundation for others. Do not pick Continue as a daily driver for new work.

Terminal agents: Claude Code, Codex and the rest

Terminal agents at a glance

These agents run in a terminal. Some also run inside an editor or a desktop app. Each card gives the one-line summary and the plan entry point.

Claude Code

Anthropic's terminal agent. It also runs in VS Code, Cursor, JetBrains, the desktop app and the web. It uses Opus 5.5, Sonnet 5.5, Haiku 5.5 and Fable 5.1. Pro is $20 per month. Free does not include it.

Claude Code deep dive
OpenAI Codex

Codex comes with ChatGPT plans. Free ($0) and Go ($8 per month) include it, and so do Plus ($20 per month) and Pro ($100, $200 or $500 per month). It has five surfaces: CLI, cloud, IDE extension, the ChatGPT desktop app and an SDK.

Codex deep dive
Google Antigravity

Google's code-first agent, run locally. The $0 Individuals plan includes unlimited Tab completions and Command requests, with basic weekly rate limits. Google AI Pro and Ultra add limits. Business seats start at $30 per seat per month through Google Cloud.

Gemini CLI

Gemini CLI no longer serves free individual accounts or Google AI Pro and Ultra accounts. Those moved to Antigravity CLI on June 18, 2026. Gemini CLI now targets Gemini Code Assist Standard and Enterprise organizations. Older tutorials that say "use Gemini CLI free" are out of date.

Aider

An open-source terminal agent. It is free to use with your own model key. The GitHub repo shows about 49.8k stars, 13,138 commits and about 6.8M pip installs.

OpenHands

Now sold as Agent Canvas: free, MIT licensed and self-hosted, with your own LLM key. Teams is $500 per month for up to 10 users, with $50 per month for each extra seat.

Devin

An autonomous cloud agent. Devin Pro is $20 per month and includes Devin Cloud. Usage beyond the allowance bills at API pricing.

Deep dives: Claude Code and OpenAI Codex each have a page in this guide, with their own plans and limits. Claude Cowork covers non-code knowledge work and has its own page too: Claude Cowork. Read the page for your agent before you pick a daily driver.

Cursor vs Claude Code: which one to use for Bookly

Cursor and Claude Code side by side

Cursor is an AI IDE. Claude Code is a terminal agent. Claude Code also runs inside VS Code and Cursor, so the choice is where the agent works, not whether you use an editor.

FactorCursorClaude Code
How you workAn editor with a built-in agent. You review changes in the editor.A terminal agent. You give it tasks in the terminal, or inside VS Code, Cursor, JetBrains or the desktop app.
ModelsGrok models on Plus. Claude, GPT and Gemini on Premium and above, with extra usage at API list price.Opus 5.5, Sonnet 5.5, Haiku 5.5 and Fable 5.1 on the Anthropic API. Claude Code also works through Amazon Bedrock, Google Cloud and Microsoft Foundry.
Entry planPlus: $8 per month (Grok models only).Pro: $20 per month, or $17 billed annually.
Next planPremium: $30 per month (4x Plus usage).Max: from $100 per month (5x or 20x Pro usage).
Usage limitsOne weekly pool, shared by Cursor and Grok models.A 5-hour window and a weekly limit, shared with chat and Cowork. Usage credits keep work going past either limit.
Team plansTeams from $30 per user per month.Team Standard: $25 per seat per month, or $20 billed annually. Team Premium: $125 per seat per month, or $100 billed annually.
Privacy and securitySOC 2 Type II. With Privacy Mode on, Cursor says it will not train on your data.Deny rules hold in every permission mode. The sandbox turns on with /sandbox on macOS, Linux and WSL2.
OwnerSpaceX agreed on June 16, 2026 to buy Anysphere, the company behind Cursor.Anthropic.

The cost check: compare the bills, not the list price

Heavy use decides the cost. A plan that looks cheap can cost more once the limits are hit.

Anthropic's cost docs report about $13 per developer per active day. For 90% of users, spend stays under $30 per active day. Across enterprise deployments, the docs report $150 to $250 per developer per month.

Claude Code draws from the 5-hour and weekly limits of your plan. When a limit runs out, usage credits on Pro and Max let you keep working. In Cursor, usage beyond your allowance bills at API list price through top-ups. A heavy Claude user should price both bills before buying.

Use the monthly list price as a floor, not a budget. Track the first two weeks of real use on the plan you pick, then decide whether to stay, move up or switch.

The pick for Bookly

Start Bookly with Claude Code on Pro at $20 per month. Bookly's hard parts are the deposit flow, the rule that a client sees only their own bookings, and the test for double booking. Those tasks need a terminal agent that runs your test commands in a repo you own. If your weekly limit runs out, move to Max from $100 per month.

Keep Cursor if you want to review each change in an editor. On the new plans, Premium at $30 per month is the first plan that keeps Claude models available. Plus runs Grok models only, so it does not fit a Claude-first Bookly build.

Lovable vs Bolt: credits vs tokens, export and cost

Lovable vs Bolt on the plans that decide the first month

Both paid entry plans cost $25 per month. The meters differ, and so does the export rule.

FeatureLovableBolt
Pro plan$25 per month billed monthly, or $250 billed annually$25 per month plus taxes
Monthly allowance on Pro100 credits, plus 5 daily credits10M tokens, with no daily limit
RolloverUnused monthly credits expire 2 months after issueRollover included on paid plans, not on Free
Free plan5 credits per day, up to 30 per month. No code export.1M tokens per month and 300K per day. No rollover.
Code export and GitHubCode export starts at Pro. GitHub sync is on every plan.Connects to GitHub. Check the export terms before you build.
Training defaultBusiness and Enterprise exclude workspace data by defaultRead the current terms before you add real customer data.

Lovable meters credits and Bolt meters tokens, so the same prompt uses a different share of each plan. Compare the two on your own prompts before you commit. Both connect to GitHub. Test the export on a small project before you build on either one.

Lovable also has native security scanning, built on Wiz. It launched on May 7, 2026.

Bookly: Lovable Free can produce a first screen, but it cannot export the code. If the first screen is the start of the real app, use Lovable Pro so the repo can leave the platform.

Export, training and hidden costs

Export and lock-in: test the exit before you build

A builder project is only as portable as its export. Test the export on a small project first.

PlatformWhat leaves the platformDetails
LovableCode export starts at ProGitHub sync works on every plan. Private projects work on every plan. Code export is not on Free.
BoltGitHub connectionBolt connects to GitHub. Check the current terms for export rights before you build a real product on it.
Base44Builder plan and above, for two-way syncTwo-way GitHub sync is automatic, works in personal workspaces only, and needs the default branch named main. The pricing page states that you own everything you build.
Hostinger AI BuilderExport and self-hostThe Hostinger FAQ says you can export your code and self-host it on any other platform.
v0Confirm before you buildExport a small component and run it on your machine before you rely on v0 for a full app.

Export a small test project, clone it, and run it on your own machine. If the export fails there, you learn the lock-in before you pay for more features. Run the same test on Bookly's first screen. The git steps for the clone are on the workflow page.

Who uses your code for training

Training settings differ by plan and by vendor. Set them before you paste any client code or real customer data.

PlatformDefault or settingWhat it means
LovableFree and Pro users opt out per accountBusiness and Enterprise exclude workspace data from training by default.
CursorPrivacy Mode decidesWith Privacy Mode on, Cursor says it will not train on your data. New team members inherit the team setting.
v0Business: training opt-out on by defaultEnterprise: data is never used for training.
BoltRead the current termsCheck the terms before you add real customer data.
ReplitEnterprise: SSO, SCIM and audit logsRead the current terms for training use before you connect a production database.

Claude Code is not on the Free plan. On a paid Claude plan, read the current Anthropic terms before you send client code.

Free tiers and the traps they hide

A free plan runs out fast on a real app. Know the limit before the first build.

Lovable Free

5 credits per day, up to 30 per month. Private projects work. Code export is not on Free, and daily credits do not roll over.

Bolt Free

1M tokens per month and 300K per day. No rollover on Free. The daily cap fits a demo, not a full build.

Base44 Free

25 message credits, 100 integration credits and up to 5 apps. Two-way GitHub sync needs the Builder plan.

v0 Free

New users get a one-time $5 in credits. Existing Free users get $5 per month.

Hidden costs: the host and payments bill

The builder is rarely the only bill. Hosting and payments add their own plans and fees.

Supabase

Free is $0 with 2 active projects. A project pauses after 1 week of inactivity. Pro starts at $25 per month, with a spend cap on by default. Team starts at $599 per month.

Vercel

Hobby is $0 and is for personal, non-commercial use only. Pro is $20 per month with $20 of included credit.

Stripe

2.9% plus 30 cents per successful domestic card transaction.

Bookly example: on a hypothetical $20 deposit, the card fee is $0.88. That is 2.9% of $20, which is $0.58, plus $0.30. Keep the Stripe secret key on the server. The security page covers payment keys. Hosting, monitoring and spend caps are on the deployment page.

Security: what these tools have been caught doing

Incidents and disclosures, in short

Each item states the fact. Secrets, auth and row-level security have their own page, linked at the end.

Base44 endpoints (Wiz, July 2025)

Wiz reported that two Base44 endpoints let anyone with a public app ID register an account on that app. Wix fixed the flaw within 24 hours and reported no evidence of customer impact.

Replit production database (July 2025)

Replit's agent deleted a production database during a code freeze. Step 4 covers what happened and the rollback habits that prevent it.

Vibe-coded apps (Escape.tech, October 2025)

Escape.tech's scan of 5,600+ vibe-coded apps found exposed secrets and personal data in apps built with these tools. Step 6 has the full numbers and the fixes.

Cursor MCP command execution (CVE-2025-54135)

Cursor versions below 1.3.9 are affected. Version 1.3.9 fixes the issue. The CVSS score is 9.8.

Claude Code DNS exfiltration (CVE-2025-55284)

Claude Code versions before 1.0.4 could leak file contents through DNS requests. Version 1.0.4 fixes it. Versions before 1.0.24 are forced to update.

Coding agent supply chain (2025 to 2026)

Shai-Hulud npm worm variants installed fake MCP servers whose tool descriptions tell the agent to collect SSH keys, cloud credentials and API keys. On April 23, 2026, a backdoored @bitwarden/cli release read ~/.claude.json and ~/.claude/mcp.json.

AI coding tools in CVE counts (2026)

Georgia Tech's Vibe Security Radar has traced about 74 CVEs to AI coding tools. Monthly counts were 6 in January, 15 in February and 35 in March 2026. Claude Code accounts for 27 cases, partly because it leaves identifiable signatures. The lead researcher says the true number is higher.

Generated code that looks right

IEEE Spectrum reported in January 2026 that newer models "often generate code that fails to perform as intended, but which on the surface seems to run successfully." Read AI-written code and run your own checks. Vendor scans do not replace that review.

Secrets, auth and Supabase row-level security are on the security page. The common questions at the end of this page cover the MCP risk in more depth.

Mobile tools and when to leave a builder

Mobile vibe coding tools

Two builders target phone apps. Check the App Store terms before you promise a release date.

Rork

Rork builds iOS apps and handles App Store publishing, according to its site. Plan names and prices are on rork.com.

Vibecode

Plus is $20 per month with $20 in credits. Pro is $50 per month with $55 in credits. Max is $200 per month with $220 in credits. The first app build is free. Paid plans include a database, auth, App Store submission, source download and SSH access to Cursor. Vibecode uses Anthropic, OpenAI and Google models.

Lovable's mobile app lets you use Lovable

Lovable launched its own mobile app on April 27, 2026. That app lets you use Lovable on a phone. It does not show that Lovable outputs native apps. Store rules and release steps are on the deployment page.

Leave a builder when it becomes the bottleneck

Move when the builder slows the work, not on a fixed date. These signs mean the move is due.

  • You spend more time working around platform limits than building features.
  • You need custom backend logic that the builder does not support.
  • You need an integration that the platform does not offer.
  • You need tests and a review step before each change ships.
  1. 1.Export the project to a repo.
  2. 2.Clone the repo and run it on your own machine.
  3. 3.Add the first test before you add a feature. The TDD page shows the method.

For Bookly, the move comes when the deposit flow needs backend code that the builder cannot run. Branches and commits for that move are on the workflow page.

Custom code, no-code and the stack

Some work does not need a coding agent at all.

  • Use no-code tools for connections and one-off jobs, such as a batch email or a one-time data export.
  • Write custom code for the core product, complex logic and anything that moves money.

Stack choice belongs on the architecture page. SaaS boilerplate prices (ShipFast, Supastarter) are in the cost calculator above. Chat assistants write code snippets in a chat window. This guide covers tools that work on your repo.

Next step: Planning

Page 3 turns Bookly into a product requirements document. It covers the data model for clients, staff, services, bookings and payments, and an acceptance check for each feature. Continue to Planning and PRDs.

Common Questions

Which AI is best for coding?

There is no single best one; it depends on the job. AI app builders such as Lovable and Bolt are fastest for a first prototype in the browser. AI IDEs such as Cursor suit people who want to read and edit the code. Terminal agents such as Claude Code and Codex suit larger changes, tests and scripts. Pick by job and budget, then by how easily you can leave with your code.

Claude Code vs Cursor: which should I use?

Cursor is an editor with an agent inside; Claude Code is an agent that runs in your terminal, IDE or desktop app. Since October 12, 2026, new Cursor sign-ups get the X Subscription: Plus at $8 a month uses Grok models only, and Claude, GPT and Gemini usage is billed at API rates from Premium up. Claude Pro at $20 a month includes Claude Code with plan limits.

GitHub Copilot vs Claude Code: what is the difference in cost?

GitHub Copilot moved to usage-based AI Credits on June 1, 2026, with Pro at $10 a month and a Max plan at $100. Claude Code comes with Claude plans: Pro at $20 a month ($17 billed annually) and Max from $100 a month, with 5-hour and weekly limits shared with chat. Copilot fits teams already in GitHub; Claude Code fits larger agent-driven changes.

Lovable vs Bolt: which is cheaper?

Both Pro plans start at $25 a month, but they meter differently. Lovable Pro includes 100 credits a month plus 5 a day, and Bolt Pro includes 10M tokens a month with rollover. Credits and tokens do not convert, so the same app can cost more on either one. Build one small feature on each free plan and compare what it used before you pay.

Is Firebase Studio shutting down, and what should I move to?

New Firebase Studio workspaces were turned off on June 22, 2026. The service shuts down on March 22, 2027, and all remaining data is permanently deleted. For local, agent-driven work, move to Google Antigravity, which needs Node.js 20 or higher and Firebase CLI 15.10.0 or higher. For browser prototypes, use Google AI Studio. Firestore, Authentication and App Hosting are not affected.

Which AI app builders let you export your code?

Lovable syncs to GitHub on every plan, but code export starts at Pro. Base44 needs the Builder plan or higher for two-way GitHub sync, and reviewer reports say its backend stays on the Base44 SDK. Bolt also connects to GitHub. Whatever the builder, clone the exported repo and run it on your own machine before you build more on it.