Somewhere right now, a founder is staring at a Lovable project with 40 paying users, wondering whether the next feature will be the one that breaks everything. Another is watching Bolt burn through tokens trying to fix a bug it introduced last Tuesday. A third is googling "export Replit app" at 11pm.

If that's you, here's the first thing to know: choosing one of these platforms wasn't a mistake. Lovable, Bolt.new, and Replit are the best tools ever made for turning an idea into a working product without an engineering team. The mistake is treating them as a permanent home when they're designed to be a launchpad.

This post answers one question: when should you move from a vibe-coding platform to something more sophisticated? Not "which platform is best" — there are a hundred comparison posts for that. This is about recognising the moment the platform that got you here stops being able to get you there, and what to do about it without rebuilding from scratch.

What these platforms actually sell you#

All three sell the same thing: speed, bought by making decisions for you. Where your code lives, how your database is set up, how deployment works, what your architecture looks like — the platform decides, so you don't have to. That trade is brilliant early on and expensive later, and the shape of the trade differs by platform.

Lovable is the purest "describe it and watch it appear" experience. It builds React front-ends on top of a managed backend — either its own Lovable Cloud or a Supabase project you connect — and its Agent Mode will now hunt through your codebase and fix things semi-autonomously. Crucially, it syncs your code two-ways with a GitHub repository you own. Of the three, it has the cleanest exit door.

Bolt.new runs an entire development environment inside your browser tab. It's astonishingly fast for spinning up interfaces and prototypes, and its newer cloud offering bundles in databases, auth, and hosting. You pay in tokens — and tokens are where the trouble starts, because complex apps make the AI re-read and re-generate a lot of code. Users consistently report that once a project grows past roughly fifteen or twenty components, the AI starts losing track of its own patterns: duplicating things, forgetting decisions, burning tokens on loops.

Replit is the most complete of the three — a full development environment, an agent that can now write and run its own tests in a real browser, and hosting with autoscaling deployments built in. It's also the most coupled. Your database, your auth, your secrets, and your hosting are all Replit services. The code exports easily; the app doesn't.

A rough map:

	Best at	Pricing model	How hard is leaving?
Lovable	Polished web apps, fast	Monthly credits	Easy — GitHub sync is built in
Bolt.new	Rapid UI and prototypes	Tokens	Moderate — code exports, backend needs re-homing
Replit	Full-stack apps with hosting	Effort-based credits	Hardest — infrastructure is Replit's

None of this is a flaw. It's the deal. The question is when the deal stops being worth it — and there are six specific signals.

Signal 1: Strangers' data is in your database#

"Someone signed up who I don't know personally. It suddenly hit me that I have no idea if their data is actually private."

This is the brightest line of all six. While your users are friends and beta testers, a security gap is embarrassing. The day a stranger trusts you with their email, their documents, or their customers' details, it's a liability — potentially a legal one.

The platforms generate apps that work, and working and safe are different properties. The most common gap is a database where any logged-in user can read any other user's rows — on Supabase-backed apps, that's row-level security being missing or wrong, and it has ended startups. The AI rarely volunteers this. No error appears. The app looks done.

You don't necessarily have to leave the platform at this point, but this is the moment you stop vibing and start verifying: a real security pass, access rules you've actually read, and someone — you, a tool, or a professional — confirming that user A cannot see user B's data.

Takeaway: The trigger isn't traffic, it's trust. The first stranger who gives you real data ends the prototype phase, whether you've noticed or not.

Signal 2: People are paying, and you're still editing in production#

"I shipped a quick copy change at 2pm. Checkout was broken until someone emailed me at 6."

On all three platforms, the default workflow is: prompt, watch it change, it's live (or one click from live). For a prototype that's a feature. For a product with paying customers it's a hair-raising way to operate, because every edit is an experiment running on the people who fund your business.

What you're missing has a boring name: environments. A place where changes are tried, tested, and verified before customers see them, and a way to roll back in seconds when something slips through. Professional teams treat this as oxygen. Vibe-coding platforms mostly treat it as an enterprise feature or don't offer it at all.

Takeaway: Revenue changes the cost of a mistake. When breaking the app costs money and trust, "edit live and hope" has to die.

Signal 3: You're paying more to fix than to build#

"Forty dollars of credits on one bug. It's still not fixed. I'm scared to open the editor."

Every platform meters you — Lovable in credits, Bolt in tokens, Replit in effort-based pricing where a complex task can cost dollars on its own. Early on the meter is irrelevant because every prompt produces visible progress. Then the app gets complex, the AI starts going in circles, and the economics quietly invert: you're spending more to keep the app standing than to move it forward.

Watch the ratio. If most of your spend last month was fixing, re-fixing, and un-breaking rather than shipping things users asked for, the platform isn't saving you money anymore — it's charging you rent on complexity it created. That money, pointed at a proper setup with tests guarding regressions, buys actual progress instead of loops.

Takeaway: Track what you spend on fixing versus building. The month fixing wins is the month the platform stopped paying for itself.

Signal 4: The AI has lost the plot#

"It rebuilt a settings page we already had. Then it 'fixed' the duplicate by breaking both."

This is the technical wall behind Signal 3. These agents work by reading your project and generating changes, and their grip weakens as the project grows. Past a certain size — users commonly report it around the fifteen-to-twenty component mark, sooner with messy structure — the AI starts forgetting its own conventions, duplicating logic, and introducing regressions faster than it fixes them. Replit's own docs concede the agent can break unrelated parts of the app while fixing something else.

You'll know this wall when you hit it: changes that used to take one prompt take ten, and each fix is a coin-flip. The platforms' one-size-fits-all architecture has no room for the things that keep large codebases tractable — enforced structure, a real test suite, code review. More prompting will not get you past this wall. Different tooling will.

Takeaway: When one-prompt changes become ten-prompt gambles, you haven't gotten worse at prompting. The project has outgrown the tool's context.

Signal 5: You need something the platform can't express#

"I just need admins to see everything, managers to see their team, and staff to see their own stuff. Three weeks. It still leaks."

Some features are thin: a page, a form, a chart. The platforms eat those for breakfast. Other features are structural — they have to be woven through every layer of the app:

• Roles and permissions that actually hold (admin / manager / member)
• Multi-tenancy — serving many organisations whose data must never, ever mix
• Background jobs — nightly emails, syncs, scheduled reports
• Audit trails for any domain where you must prove who did what, when
• Deep integrations — Xero, a government API, a partner's system

Prompt-built codebases handle structural features badly because the AI bolts them on per-screen instead of enforcing them everywhere, and a permission system that's 95% enforced is 100% broken. If your roadmap has two or more items from that list, you're not building a prototype anymore — you're building software, and software needs an architecture that was chosen, not accumulated.

Takeaway: Pages and forms are platform-friendly. Permissions, tenancy, and integrations are architecture — and architecture is exactly what these platforms don't let you control.

Signal 6: You're no longer the only builder#

"I hired a contractor. He looked at the project for a day and quoted me a rebuild."

Two people prompting the same vibe-coded app multiply the chaos: no review step, no tests to catch each other's regressions, conventions that exist only in the AI's fading memory. And when you bring in professional help, the state of the codebase is your negotiating position. A repo with structure and tests gets you an engineer who improves it. A 60,000-line tangle that only Lovable understands gets you a rebuild quote.

Takeaway: The codebase is fine as long as it only has to survive you. The day someone else touches it, its real condition becomes the bill.

What "more sophisticated" actually means#

Here's where most advice goes wrong, in one of two directions: "just learn to code" (you have a business to run) or "hire an agency to rebuild it" (slow, expensive, and it throws away working software). The real move is smaller and cheaper than either:

You keep building with AI. You change who owns the structure.

Concretely, graduating means five things:

1. Your code lives in a repository you own — on GitHub, not inside a platform. Lovable makes this nearly free: turn on GitHub sync and the repo already exists. Bolt exports to GitHub too. Replit takes more work, because the code is the easy part — the database, auth, and hosting need new homes.
2. You switch to an AI tool that works on your repo — Claude Code or Cursor instead of the platform's chat box. Same workflow you already know — describe what you want, review what it builds — but on code you own, with no meter charging you to escape.
3. Tests guard every feature, written by the AI, run automatically on every change. This single habit kills the whack-a-mole cycle that defines late-stage platform life.
4. Changes go through a pipeline — checks pass, then it ships, and you can roll back. No more editing in production.
5. The structural stuff sits on proven foundations. Auth, roles, multi-tenancy, and audit trails are solved problems with battle-tested patterns. You inherit them; the AI fills in your features on top.

Notice what's not on the list: a rebuild. Your product, your UI, your validated idea — they come with you. What changes is the scaffolding around them. And the platforms themselves are honest about this path: the well-worn route in the community is prototype on the platform, then graduate to Cursor or Claude Code via GitHub. Even their own guides describe it.

When you should NOT move#

Quality means telling you the other half. Moving too early is a real failure mode — I'd argue it kills more projects than moving too late, because it swaps momentum for plumbing before you've earned the need for plumbing.

Stay on the platform while:

• You're still validating. No strangers' data, no revenue, still discovering what the product even is? The platform's speed is worth more than any architecture. Iterate.
• It's an internal tool or demo. Five colleagues using a dashboard doesn't need CI/CD. Honestly, it may never need to graduate.
• You'd be moving out of fear, not signals. "Real startups don't use Lovable" is not a signal. Paying customers and a leaking permission model are signals.

The platforms are not the enemy of serious software. They're the best first chapter it's ever had. Just don't let chapter one run long enough that the rewrite costs more than the book.

The one-question test#

If you only take one thing from this post, take this. Ask yourself:

"If this platform shut down tomorrow, how long until my app runs somewhere else?"

If the honest answer is "a day or two" — your code is in GitHub, your database is somewhere you can reach, nothing critical is locked to the platform — you're in good shape, whatever stage you're at. Stay as long as it serves you.

If the honest answer is "I genuinely don't know," that's not a tooling preference anymore. That's your business depending on a single vendor's pricing page. You don't need to panic, and you don't need to move this week. But you should start the move before a signal forces it — because every one of the six above is cheaper to act on early, and they don't send a calendar invite.

---

Get the playbook#

I help non-technical founders take AI-built products to production — which means I've seen where every one of these six signals leads when it's ignored, and how cheap each one is to handle early.

The free guide covers the whole graduation path in detail: the export checklist for each platform, the security audit to run before strangers touch your app, and how to set up an AI workflow on your own repo so you keep the speed without the meter.

---

Where are you at?#