Last updated: October 17, 2026
AI app builders can produce a working internal tool, intake form or landing page in an afternoon for $20 to $50 a month. They are good for prototypes and tools that never touch client data. Once an app stores confidential records, takes payments or faces the public, budget for a developer review before launch.
Where things stand
The field splits into two groups. Browser builders (Lovable, Bolt.new, v0, Replit) take a plain-English description and give you a running app with hosting, often a database and login included. Coding agents (Claude Code, OpenAI Codex) work on code in a folder or repository, which gives you more control but assumes someone is comfortable with a terminal or a code editor.
Pricing has moved to credits almost everywhere, which makes the monthly bill hard to predict. Lovable’s own docs list small edits at under one credit and larger features at more; Pro starts at $25 a month for 100 credits. Bolt.new Pro is $25 for 10 million tokens. v0 Plus is $30 per user with $30 of credits. Replit Core is $20 a month including $20 of model usage. A tool that is cheap to start can get expensive during a long debugging session.
Where the data lives matters more than which tool writes the nicest code. Lovable Cloud hosts your database, file storage and logins on Lovable’s infrastructure (built on Supabase’s open-source foundation), with a choice of Americas, Europe or Asia Pacific region that cannot be changed later. Moving off it is a manual export and rebuild. Bolt, v0 (on Vercel) and Replit similarly host for you by default. Coding agents leave the code in your own repository and let you deploy wherever you want.
Security is the weak spot. An August 2026 survey of 600 U.S. non-developers by hosting company 20i found 83.8% had hit problems with AI-generated code, 9.3% did no verification at all, and 20.5% said AI code contributed to a security breach (self-reported). Researchers reported exposed data in Lovable-built apps in February 2026; Lovable’s response was that every project gets a pre-publish security scan, but acting on it is the user’s job. A further, broader breach claim posted in April 2026 has not been independently confirmed.
Training opt-outs vary by plan. Lovable Business ($50 a month and up) excludes workspace data from model training by default; v0 does the same on Business ($100 per user). On cheaper tiers you usually have to opt out yourself, or cannot.
| Tool | Best for | Cost (checked Oct 2026) | Our take |
|---|---|---|---|
| Lovable | Client portals and internal dashboards with login and a database | Pro from $25/mo (100 credits); Business from $50/mo with SSO and training opt-out | Fastest route to a full app. Use Business for anything with client data, and run the security scan. |
| Bolt.new | Quick prototypes and small web apps | Free tier; Pro $25/mo (10M tokens); Teams $30/member | Generous free tier for trying ideas. Unused Pro tokens roll over for a limited time. |
| v0 (Vercel) | Landing pages and front-end screens | Free (7 messages/day); Plus $30/user; Business $100/user | Strong on design and layout. Pair with a real back end if you need one. |
| Replit Agent | Internal tools with scheduled jobs or scripts | Core $20/mo; Pro $100/mo | Full coding environment plus hosting. Good when a tool needs to run on a schedule. |
| Claude Code | Changes to an existing site or codebase; tools you host yourself | Included with Claude Pro ($20/mo) and Max ($100 or $200/mo), per a June 2026 price tracker | Code stays in your repo. Needs someone comfortable reviewing changes. |
| OpenAI Codex | Same use as Claude Code, for ChatGPT shops | Included in ChatGPT Business seats; usage beyond plan limits billed in credits | OpenAI estimates $100 to $200 per developer per month at heavy use. |
What a small office should do now
Good first projects: an internal intake checklist, a staff-only dashboard that reads from a spreadsheet, a one-page campaign landing site, or a prototype you will hand to a developer as a working spec. These are low risk and save real time.
Before building anything that stores client information, decide where the data will live and write it down. Pick the region that matches your obligations, use a plan with training excluded by default, and keep a copy of the code in your own GitHub account.
Hire a developer, at least for a review, when any of these apply:
- The app stores privileged, medical (HIPAA), or financial records.
- It takes payments or handles login for the public.
- Staff will depend on it daily and nobody in-house can fix it when it breaks.
- It connects to your practice management system, accounting software or email with write access.
When not to bother: if a spreadsheet, a form tool or an off-the-shelf product already does the job, use that. A custom app is something you now maintain. Most offices need two or three good automations far more than a new app.
What we’re watching
- Whether Lovable or independent researchers confirm or rule out the April 2026 breach claim.
- Credit pricing changes; several of these tools have repriced in 2026.
- Built-in security scanning that blocks publishing, rather than only warning.
- HIPAA business associate agreements from browser builders, which none of the pricing pages we checked mention.
Sources
- Lovable docs: subscription plans (checked October 2026)
- Lovable docs: plans and credits (checked October 2026)
- Lovable docs: Lovable Cloud (checked October 2026)
- Bolt.new pricing (checked October 2026)
- v0 pricing (checked October 2026)
- Replit pricing (checked October 2026)
- PricePerToken: Claude subscription plans (page updated June 2026; checked October 2026)
- OpenAI Help: Codex pricing for Business and Enterprise (checked October 2026)
- 20i: Survey on how businesses use vibe coding (August 2026)
- Bastion: Lovable April 2026 data breach claims (checked October 2026)
Changelog
- 2026-10-17 — Page created.