Building an Internal Tool Without a Developer: Lovable, Bolt, v0, Replit and More

Most businesses have a tool they wish existed. A quote calculator the team can use on site. A page where staff log equipment checks. A simple portal where clients upload documents and see their status. It is too small for a software project and too specific for an off-the-shelf product, so it lives in a spreadsheet and a group chat.

A new group of AI app builders aims at exactly this gap. You describe what you want in plain words, the tool builds it, and you publish it without a developer. Lovable, Bolt, v0, Replit, Base44 and Bubble all sit here. They are different products with different catches, and the first working screen looks the same in all of them.

This guide draws on our own reviews of the six, the vendors' product pages, and two independent sources on security and privacy, linked at the end.

Quick answer: for a prototype or a tool that holds no personal information, any of these can get you a working first version in an afternoon. Pick Lovable, Bolt or v0 if you want to describe the app and refine it by chat. Pick Replit or Base44 if you want hosting, database and sign-in in one place. Pick Bubble if you will keep building and maintaining the app yourself and can accept that the code stays with Bubble. Before customer or staff data goes in, get someone who understands access control to review who can see what.

What these tools actually do for you

All six take a description and produce something that runs. Beyond that they differ in how much of the rest they provide.

Bolt describes itself as a way to create apps and websites by chatting with AI, and its cloud product bundles hosting and databases. v0 builds full-stack apps from a prompt and offers one-click deployment on Vercel, or a pull request for someone to review. Replit bundles authentication, a database, hosting and monitoring as built-in services. Base44 lists a backend, authentication, a database and hosting as built in. Bubble is a visual builder with a built-in database, hosting and a set of privacy rules you configure yourself. Lovable builds an app from a description and gives you security scans before you publish. Lovable's own site blocked our automated fetch, so what we say about it comes from its security documentation and our review.

The shared promise is that you do not need a developer. For the first version that is largely true. For the version your team relies on every day, the questions below matter more than which tool wrote the first screen.

Which one fits which person

Our reviews put the strengths this way.

• Lovable is good for turning a plain description into a working app without writing code. Skip it if you need predictable costs while you debug.
• Bolt is good for building websites and apps in the browser, with hosting and databases included. Skip it if you plan to build large projects on the free plan.
• v0 is good for turning a description into a working web app and publishing it to Vercel. Skip it if you need unlimited generations on the free plan.
• Replit is good for non-developers who want to build and host an app from a prompt. Skip it if you need predictable monthly costs.
• Base44 is good for building a working app, with backend, database and sign-in, from a prompt. Skip it if you expect your published app to run without usage charges.
• Bubble is good for building full web apps visually, with a database and workflows, without code. Skip it if you want the code to take elsewhere.

Read the "skip if" lines first. Most of them are about money.

The catches we have checked

Each tool has one catch our reviews flag, and they follow a pattern.

Credits and usage. Lovable's free plan gives a few credits a day that expire, and reviewers report that failed fix attempts spend credits, so a debugging loop can use an allowance quickly. Bolt's free plan has monthly and daily token caps, and larger apps can reach the daily cap in one sitting. v0's free plan has a small daily message limit, and sources disagree on plan names, so check the live pricing page. Replit bills AI agent usage on top of the plan, so heavy building can push the bill past the headline price.

Running costs as well as building costs. Base44 uses two credit pools, one for building and one for running your app. If the running pool empties, your app's features stop for the people using it. For an internal tool the whole team depends on, that is the catch to understand before you commit. Bubble charges follow how much work your app does, so a busy app can jump a plan, and it takes real time to learn.

Lock-in. Bubble's code cannot be exported. If you outgrow it, you rebuild. For the others, ask the vendor how you get your code and data out before you build anything you cannot afford to redo. We have only confirmed the Bubble limit.

Plans, limits and prices change often in this category. We do not quote figures here for that reason. Open each vendor's plan page on the day you decide.

The question that matters more: who can see what

A working screen tells you nothing about access. The most common way a quickly built app goes wrong is not a hacker. It is a page or a table that shows one user's data to another, or to anyone with the link.

The OWASP Top 10, the standard awareness list of web application risks, ranks Broken Access Control first in its 2025 edition. That is the category this describes. AI-built apps are not special here, but the people building them often have no reason to think about it, because the app works when they test it as themselves.

Two vendors say as much. Lovable's documentation says database access rules control which users can access or modify data, describes misconfigured rules as a common cause of data leaks, and offers a quick scan that runs when you publish and a deeper scan you start yourself. It also says these tools cannot promise complete security and that apps handling sensitive data should get an additional professional review. Bubble describes privacy rules as the setting that dictates who can access what, and you set them yourself.

That is the honest position across the category. The tool can build it. Whether it is safe to put real data in is a separate check, and it is yours.

Before real data goes in

If the app will hold customer names, contact details, health or financial information, or staff records, work through this first.

1. Test as a different user. Create two test accounts. Log in as one and try to reach the other's records, by changing the address or using a saved link. Do it while logged out as well.
2. Run the vendor's own checks. Use the scan Lovable offers before you publish. Look for the equivalent in the tool you pick, and ask what it does not cover.
3. Know where the data lives. Find out which database and hosting the tool uses and where your data sits, then write it down.
4. Have someone review it. For anything beyond a throwaway, pay for an hour or two of a developer's or agency's time to check access rules. It costs little next to a leak.
5. Plan for the rules on personal information. In Australia, the Privacy Act's security principle (APP 11) requires reasonable steps to protect personal information from misuse, interference, loss and unauthorised access, and to destroy or de-identify what you no longer need. The Office of the Australian Information Commissioner says reasonable steps include technical and organisational measures. Whether the Act applies to your business depends on its size and activity, so check the regulator's guidance or ask an adviser. This is not legal advice.

If you do not want to take on those checks yourself, that is a good sign you need a person involved. An agency can build the app on a tool you keep, or review one you built.

When to stop and hire help

Builders like these are good at a first version and weak at the long tail: odd cases, integrations with the systems you already run, and a security review. A sensible path is to prototype it yourself, prove that people use it, then have someone build or review the real one. You still own the idea and the design, and you spend developer time on a clear target.

Where to start

• Compare the tools side by side on the compare page and read each full review.
• Browse the code generation category for more tools in this space.
• If you want a recommendation for your situation, ask the Concierge.
• If the app touches customer data or other systems, look at AI agencies that build and review this kind of work.

Sources

• Lovable documentation, security scanning and row-level security, read 13 October 2026.
• Vendor product pages for Bolt, v0, Replit, Bubble and Base44, read 13 October 2026.
• OWASP Top 10:2025, read 13 October 2026.
• OAIC, APP 11: Security of personal information, updated 3 October 2025.