v0 and Lovable let a prototype skip straight to production

v0's debut, dated 11 October 2023

Vercel announced v0 on 11 October 2023 as a way of 'combining the best practices of frontend development with the potential of generative AI', turning a written description into interface code. The original framing was explicitly a starting point rather than a finished product: v0 generated 'React, Tailwind CSS, and Shadcn UI' code that a developer would 'copy and paste that code into your app and develop from there'. That copy-and-paste model placed a person's own project, and by implication their own review, between the generated snippet and anything a user would see.

What each product's current documentation claims

Both products have since grown beyond that model, and their documentation describes what they do as retrieved on 16 September 2026, not as either launched. v0's current documentation describes generating 'real code and full-stack apps' with the option to 'deploy to production immediately, or open a pull request for review' — a genuine choice the documentation states plainly, not a single mandatory path. Lovable's documentation describes a comparable but distinct product: a generated application with 'frontend, backend, database, authentication, and integrations, all backed by editable code', published to 'a live URL', with users retaining 'full ownership of your code' and able to 'sync it to GitHub, GitLab, or Bitbucket'. Its documented workflow is to 'review and iterate on your app' before publishing, though the review step is described as part of iterating, not as a gate the platform enforces.

Where a prototype stops being a prototype

The friction sits exactly where the two products diverge from the 2023 copy-and-paste model: once a generator can deploy straight to a live URL or production infrastructure, skipping a pull request is a documented option, not a failure of the tool. Neither documentation set states what happens to a generated authentication setup, database schema or third-party integration under real user load, and neither describes an independent security review as part of the standard path — the review, where it exists, is a choice the person building the app has to actively take, such as opening a pull request instead of deploying immediately. A team that treats 'deploy to production immediately' as the default has, by the platform's own description, treated a generated interface as a finished product without necessarily changing anything else about how it is checked.

• Does 'deploy immediately' or 'open a pull request for review' happen by default, and who chose that setting?
• Who reviews a generated backend, database or authentication setup before real users or real data reach it?
• What does 'full ownership of your code' change in practice if nobody on the team can read the generated code?

Interfaces generated from a sentence are a genuine change in how quickly something can look finished. Whether it is actually finished still depends on a review step that both platforms describe as available, not as required.