Do You Still Need a Software Agency in the Age of Lovable and Base44?

You often do not need a software development agency to build a prototype or a simple internal tool any more. Lovable, Base44 and similar AI app builders can do that in hours. You still need experienced engineers when software holds customer data, takes payments, connects to other systems, or has to keep working once the business depends on it.

So the point of working with an agency has changed. Typing code is no longer what you are paying for. You are paying for judgement about what to build, and for someone who is accountable when it has to work.

We should declare our interest: we are one of those firms. We also build with AI every day, and we think some projects that would have come to an agency five years ago should now start with one of these tools. This guide sets out where we think the line falls.

What Lovable and Base44 actually changed

AI app builders turn a written description into a working application. Their growth shows how much demand there was. Sacra estimates that Lovable reached $600 million in annualised revenue by September 2026, and Wix bought Base44 in June 2025, in a deal reported at about $80 million.

For a business, three things are now truly different:

• Testing an idea is cheap. A founder can put a working demo in front of customers within days, at the price of a modest subscription.
• Non-technical people can build. Operations and marketing teams can make their own small tools, without waiting in a development queue.
• Briefs have improved. A clickable prototype explains what you want far better than a long document.

Those are real gains, and an agency that dismisses them is not being straight with you.

Agency or AI builder? It depends on the job

What AI app builders do not solve

Knowing what to build

AI will build what you ask for, including the wrong thing. It rarely tells you that the feature is unnecessary, that a cheaper tool already does this, or that your idea will clash with how the business really runs. Before cheap code, slow delivery limited how much bad software a company could produce. That limit has gone, so deciding what not to build matters more than it used to.

Security you did not know to ask for

A demo can look finished while its data is exposed. Veracode's testing of more than 100 AI models found that 45% of generated code samples introduced OWASP Top 10 vulnerabilities. That is a controlled benchmark, so it does not mean that 45% of live applications are vulnerable, but it does mean generated code needs checking.

App builders face this at both the application and the platform level:

• One researcher's scan of 183 public Lovable apps reportedly found that 99% had at least one security issue, mostly database access rules that were misconfigured. The researcher notes that the same patterns appear in hand-written apps, so the lesson applies well beyond Lovable: a working app can still be an unsafe one.
• In July 2025, Wiz disclosed an authentication flaw in the Base44 platform that could have exposed private applications. It was fixed in under 24 hours, and Wix confirmed no evidence of past abuse. That is a good response, but it shows that your security also depends on the platform underneath you.

Both products have continued to evolve, including their security tooling. An automated scan is a useful step. It is not the same as someone who understands your data working out who should be able to see what.

Connections to the real business

Standard integrations are often easy. The hard ones involve an old ERP with no good API, customer records that disagree across three systems, or an approval process that exists only in someone's head. Most of that work is understanding the business and its data, and only then writing the code.

The tenth change, not the first

AI builders are at their most impressive on day one. Things tend to get harder as an application grows. Each new prompt can break something that used to work, and costs can climb when the tool gets stuck in a cycle of fixing its own errors. Software is mostly maintained rather than written, so the question to ask is what your app will be like to change in two years.

Ownership and exit

Check how each tool handles this before you commit. Lovable syncs your project with GitHub, which gives you code you can take elsewhere, although you will still need someone able to run it. For Base44, third-party migration guides report that exported code keeps relying on Base44's managed backend for the database, login and business logic, so leaving may mean rebuilding those parts. Policies change, so read the current documentation.

Someone to call

When an app goes down during your biggest sales day, or a customer reports seeing another customer's data, a subscription does not give you a person who knows your system and is contractually responsible for it. If your business needs that, make sure someone is providing it.

Vibe coding vs software engineering

"Vibe coding" describes building software by prompting an AI and judging the result by whether it seems to work, usually without reading the code. Software engineering also uses AI heavily now, but with review, testing, architecture and responsibility for what ships. The tools can be the same, and the difference lies in the process around them.

What is the point of a software agency now?

A good agency's value now sits in the parts AI does least well.

• Technical judgement. Which problem is worth solving? What should you buy instead of build? What will be expensive to change later?
• Architecture. Data structures and security decisions that are hard to fix after customers arrive.
• Integration. Making new software work with the messy systems you already have.
• Review of AI output. People experienced enough to recognise generated code that looks right and is wrong.
• Accountability. A contract, a team and clear responsibility when something fails.
• Taking a prototype to production. Security, reliability, monitoring and deployment, all without throwing away what you have learned.

Good agencies should also be faster and leaner because of AI. If a firm quotes as though these tools do not exist, ask why.

Which agencies should worry

Firms that mainly turn specifications into standard screens, with little advice or responsibility, are in trouble, because that is exactly what these tools now do. If an agency cannot explain what it adds beyond writing the code, a subscription may be the better deal.

When you do not need an agency

• You are still testing whether anyone wants the idea.
• It is an internal tool for a small team, with no sensitive data, and a failure would only be an inconvenience.
• It is a temporary tool for a campaign or an event.
• Your site is a simple marketing or brochure site.
• An existing product already does most of what you need.

When you do need experienced engineers

• You store personal, financial or health data, or you take payments.
• Customers are paying you, and an outage would cost you money or trust.
• You need to connect to enterprise or legacy systems.
• You face regulation or customer security reviews, including enterprise procurement.
• Your AI-built app has become hard to change, and fixes keep breaking other parts.
• Investors or buyers will examine your technology during due diligence.

The best approach usually combines both

1. Prototype with an AI builder. Spend days, not months, finding out whether the idea works.
2. Test it with real people. Our guide on how to validate a startup idea covers how to do this.
3. Get an independent technical audit before scaling. Find out what can stay, what must be fixed and what it will cost.
4. Harden or rebuild the risky parts. Usually that means login, data access, payments and integrations.
5. Decide who owns it long term. That could be an internal hire, a partner or a mix. See outsourcing vs in-house development.

A prototype made this way is a very good brief. It costs little to make, it shows what you mean, and it has already taught you something about your customers.

A security checklist for vibe-coded apps

Go through this before real users or real data touch your app. It does not replace a professional review, but it catches common problems.

• Access rules: create two test accounts, and confirm that neither can see or change the other's data, including by editing IDs in the URL.
• Database permissions: if your app uses Supabase, check that Row Level Security is on for every table, and that each policy does what you expect.
• Secrets: make sure no API keys are visible in browser code or committed to a repository.
• Server-side checks: permissions and prices must be enforced on the server, because anything in the browser can be changed.
• Admin functions: confirm that admin pages and endpoints are not reachable by ordinary users.
• Payments: verify payment confirmations on the server, and test failures and refunds.
• Abuse limits: add rate limits to logins, forms and anything that costs you money, particularly AI features.
• Backups: confirm that backups exist, and try restoring one.
• Privacy: know what personal data you collect and where it is held, and meet the rules that apply to you, such as GDPR or Japan's APPI.
• Monitoring: set up alerts, so that you find out about failures before your customers tell you.

Questions to ask an agency in the age of AI

1. How do you use AI in your work, and how does that show up in your pricing and timelines?
2. How do you review AI-generated code before it ships?
3. Would you advise us to use a tool like Lovable instead? In which cases?
4. Can you work from our existing prototype, or will you insist on starting again? Why?
5. Who is responsible if something fails after launch?
6. Do we own the code, data and accounts from day one?

The third question is the most revealing. An agency that says you always need it is telling you about its sales targets.

Frequently asked questions

Do I still need a developer if I use Lovable or Base44?

Not for an early prototype or a simple low-risk tool. You should involve one before handling real customer data or payments, or when the app becomes important to your business. A short review can be far cheaper than fixing a data leak.

Is Lovable good enough for production?

It can be for some applications, particularly with the code synced to GitHub and reviewed by someone experienced. Whether yours qualifies depends on your data, your users and the cost of failure. A successful demo does not settle that question.

Is Base44 safe?

It is a widely used platform, and it fixed its 2025 authentication flaw quickly. As with any platform, the safety of your app also depends on how it is configured. Review its access rules and data handling, and check the current security documentation before storing sensitive data.

Will AI replace software developers?

It is already changing the job. AI handles more of the routine coding, while design, review, integration and accountability take up more of a developer's time. Nobody can say for certain where this ends, but companies will still need people who understand their systems and answer for them.

Can an agency fix an app built with Lovable or Base44?

Usually, yes. An experienced team starts by auditing the app, then decides whether to fix it or rebuild parts of it. What you can keep depends on the code quality, how far you can export it and how your data is structured.

Is it cheaper to use an AI builder than an agency?

Almost always at the start. The total cost is less clear for a serious product once you include your own time, usage credits, rework, security and any later rebuild. Compare costs over the life of the product, as well as the cost of the first version.

How Reserved works with AI-built products

Our view is on our homepage: AI made writing code easy, but turning it into software that a business can rely on still takes judgement, integration and accountability. We take ideas and AI prototypes through to deployed products, and provide technical consulting when you need senior advice more than extra hands.

If you have built something with Lovable, Base44 or another tool and are not sure whether it is ready for real customers, send it to us. If it is good enough as it stands, we will tell you.