Every day on X, people share apps they just built with Lovable, Base44, Bolt or Cursor. I wanted to know what those apps look like from the outside on the day they're shared, so this week I ran our free Throttle Bird check on 34 of them.
I'm not naming any app, and I never will. Everything below is totals. If you built one of these apps, nobody can tell from this post.
The short version
- I checked 34 live apps that their makers shared publicly on X between Oct 20 and Oct 24, 2026. Most were built with Lovable or Base44. 15 were on a lovable.app address, 11 on a base44.app address, and 8 on their own domain.
- The good news first: none had a secret key sitting in the page, and none had a database that answered a stranger.
- 100% were missing basic browser safety settings (called "security headers").
- 85% had no sitemap and 79% didn't tell Google which address is the real one, so new visitors from search will have a hard time finding them.
- 47% had a first load that was slower than it should be.
- 29% had missing or incomplete social preview tags, so a shared link can show up blank.
- Grades: 8 B's, 23 C's, 3 D's, no A's. The typical app had 4 things to fix, and most of them take one prompt to your builder.
Two more apps I picked were already offline when I checked, so I left them out.
Why this matters on launch day
None of this means these apps are bad. Most of them are genuinely cool, and a C here usually means a handful of boring settings nobody told the maker about. But launch day is when strangers show up for the first time, and it's also when a missing setting is most likely to cost you a visitor, a signup, or a bad first impression.
Here's what each one means and what to paste into your builder to fix it.
1. Security headers (every app was missing them)
Security headers are short instructions your site sends to the browser, like "don't let other sites put my page inside a frame" or "only load scripts from places I trust." Visitors never see them, but they close the door on whole kinds of attacks. Builder tools almost never add them for you.
Add standard security headers to every page of my site: Content-Security-Policy
(start with a policy that allows my current scripts, fonts and images),
Strict-Transport-Security, X-Content-Type-Options: nosniff,
Referrer-Policy: strict-origin-when-cross-origin, and a frame-ancestors rule so
other sites can't put my pages in a frame. Use my hosting platform's headers
config. Then tell me in plain English what each one does and check nothing on
the site broke.Some builder hosting doesn't let you set these yourself yet. If yours doesn't, it's worth asking their support, or connecting your own domain through a host that lets you add headers. We have a longer guide here: how to add security headers to your vibe-coded app.
2. Google can't find you easily (85% had no sitemap)
A sitemap is a list of your public pages that Google reads. A canonical tag is a hidden line on each page that says "this is the real address." Without them, a brand-new app with few links can take weeks to show up in search, or show up under the wrong address.
Create a sitemap.xml at the root of my site that lists every public page with
its full https address on my real domain, and a robots.txt that allows search
engines and points to the sitemap. Add a canonical link tag to every page that
points to that page's own main https address. Leave out login, dashboard and
account pages.If you want the full walkthrough, read why your vibe-coded app isn't on Google.
3. A slow first load (47%)
About half the apps took longer than they should to send the first page. On a phone with a weak connection, that's the moment people give up.
Make my homepage load faster for first-time visitors: compress and resize
images, lazy-load anything below the fold, remove unused libraries, and set
sensible cache headers for static files. Tell me what you changed and how much
smaller the page got.4. Blank link previews (29%)
When someone shares your link on X, iMessage or Slack, the preview card comes from a few hidden tags. If they're missing, your launch post shows a bare link.
Add Open Graph and Twitter card tags to my homepage: og:title, og:description,
og:image (a 1200x630 image of my app), og:url with my real address, and
twitter:card set to summary_large_image.The good news, again
I want to say this clearly because the "vibe-coded apps are a security disaster" take is everywhere: in this sample, no app leaked a secret key in the page and no database answered a stranger. That's better than I expected. What's left is mostly settings that take a few minutes each.
That matches what we saw earlier this month when we checked 76 apps from public directories. Almost every app was missing security headers, and the dangerous problems were rare.
How I did this
- I picked apps their makers had shared publicly on X this week, mostly from "built with Lovable" posts and the Base44 challenge. I didn't choose apps based on how they looked.
- Each homepage got exactly one run of the same free check anyone can run on throttlebird.com. No logins, no extra probing, homepage only.
- I only kept totals. I didn't store any key, table name, or detail that could help someone target a specific app.
- 34 apps is a small sample, so treat the percentages as a rough picture, not a census. I'm going to run this again next week and compare.
If you're about to launch, you can run the same free check on your own app. It takes under a minute and you don't need to sign up. If you shared your app on X this week and want the full report, reply to me @ThrottleBirdhq and I'll send it over free.
Jordan