Most studies of vibe coding look at the code: how many vulnerabilities, how much technical debt. We wanted to look at the other side. Once an app is live, what does a stranger, a search engine or a spam filter actually get?

So in early November 2026 we ran the same check on 312 apps their makers had shared in public, on showcases like Made with Lovable and Made with Bolt and in launch posts on Reddit. One check per homepage, one site at a time, respecting robots.txt, and we kept only totals.

The short version: only 1 in 5 (19%) scored 90 or more out of 100. Very little of what held the others back was about code quality. Most of it is invisible when you click around your own app.

What we found Share of apps
No analytics we could find 68%
Own domain, but missing SPF or DMARC (213 apps) 53%
Almost empty page without JavaScript 49%
Headline doesn't say what the app does or who it's for (171 readable) 42%
Over 4 seconds to show the main content on a phone 37%
No sitemap 37%
Page title missing, default, too long or unclear 30%
Empty card or no image when the link is shared 20%

Half the apps look empty without JavaScript

Many AI-built apps arrive as a near-empty HTML shell and fill in a moment later. You see your app. Anything reading the raw HTML sees a few words and a script tag.

Builder Almost empty page
All 312 apps 49%
Lovable (159) 55%
Base44 (33) 48%
Bolt (42) 76%
Other tools (78) 21%

To be fair about what this means: Google runs JavaScript, later and not always completely. Link previews on WhatsApp, Slack and LinkedIn don't, and most AI assistants' crawlers don't either. Lovable (for apps created before 13 May 2026) and Base44 also send a pre-rendered page to crawlers they recognise, so for those apps Google may see more than we did. The number is what a visitor without JavaScript gets.

To see what Google itself gets, use URL Inspection in Search Console and open View crawled page. If your text isn't there:

Make my public pages (homepage, pricing, about and any guides) load as complete HTML without needing JavaScript, using server-side rendering, pre-rendering or static pages, whichever fits my setup. Search engines and social sites must be able to read the headline, text, title and description directly. Keep the logged-in app working exactly as it does now. Tell me which approach you used and how I can check it.

Two thirds can't see their visitors

68% had no analytics we could find, and 94% of Base44 apps. Without it, a launch is a guess: you post somewhere, nothing seems to happen, and you can't tell whether nobody came or everybody came and left. A simple cookieless counter is enough to start.

Half the custom domains aren't set up for email

Of the 213 apps on their own domain, 53% were missing SPF or DMARC. Sign-up confirmations and password resets are then more likely to land in spam, and the person who tried to sign up just looks like a visitor who left.

Set up my app to send all authentication emails (sign-up confirmation, magic link, password reset) through my own email provider using custom SMTP, from the address hello@yourapp.com with the sender name [App name]. Don't change anything else. Then list the exact DNS records I need to add for SPF, DKIM and DMARC, and tell me where to add them.

A headline a stranger doesn't get

We could read the headline on 171 pages, and 42% didn't say what the app does or who it's for. The audience was the usual gap: 59 of the 71 misses said what the app does but not who it's for.

Rewrite my homepage headline and the sentence under it so a stranger instantly understands what my app does and who it's for. Plain words, no buzzwords, under 12 words for the headline. My app: [what it does]. It's for: [who]. Give me three options before changing anything, and explain in one line what each one emphasises.

Launch readiness by builder

Builder Score 90 or more Score under 70
All 312 apps 19% 16%
Lovable (159) 19% 9%
Base44 (33) 3% 33%
Bolt (42) 5% 43%
Other tools (78) 32% 8%

"Other tools" is mostly apps shared on Reddit where we couldn't tell the builder. They scored best, and we don't know why: it may be that those makers are more technical.

What this doesn't show

  • Showcased apps aren't all apps, and makers who share their work may be ahead of the rest.
  • One check is one moment.
  • Our check reads each page's HTML as it arrives, the way link previews and most AI crawlers do. It isn't Google. The speed numbers come from Google's own test, which does run JavaScript.
  • We work on LaunchPal, the launch check we used, so weigh that too. Results for individual apps were deleted, and no app is named.

Full method and more numbers: the report.

What did you only find out after launching? I'm curious what we should be checking that we aren't.

To see where your own app stands, the free LaunchPal launch check runs the same checks in about a minute, with a prompt for each problem. No sign-up.