Building an app went from a six-month project with a team to a weekend with a subscription. The build is no longer the hard part. Finishing is.
The stack that works right now
- Prototype: Lovable, Bolt or v0 to get a working shape in an hour.
- Real development: Cursor or Claude Code once the prototype needs to become software.
- Backend: Supabase for Postgres, auth, storage and row-level security.
- Deploy: Vercel or Netlify.
- Payments: Stripe. Charge from day one; free users teach you almost nothing.
The five-step build
Write the spec before the prompt
One page: who it is for, the single job it does, the three screens, the data model. Skipping this is why prompted apps sprawl into unmaintainable messes by day three.
Prototype the riskiest screen first
Not the login. The screen that has to be good for the product to be worth using. If that screen is not compelling, stop and rethink.
Wire real data early
Mock data hides every hard problem. Connect the database in the first session so the difficulties surface while the app is still small.
Handle the unglamorous
Auth, errors, empty states, loading, mobile, and what happens when the model call fails. This is the work that separates a demo from a product, and it is where most AI-built apps die.
Ship to ten real users
Not a launch. Ten people who will tell you the truth. Fix what they hit, then widen.
The security part you cannot skip
Generated code will happily expose API keys client-side, skip authorisation checks on endpoints, and trust user input. Before you go public: keys server-side only, row-level security on every table, rate limits on anything that costs you money, and a real look at what an unauthenticated request can reach. See alignment and safety for the agent-specific version.
Tools
Building on-chain instead? Go to dApps. Building for play? games.