The vibe-coded Baltics: 311 Lovable sites are already in production

The Baltic Web Audit, our near-census of the web in Latvia, Estonia and Lithuania in July and August 2026, counted the platform behind every site it could identify. For the first time that list included a site builder driven by a prompt rather than a person. Lovable was detected on 311 live sites. This piece is about what that number means, and about the question a founder with one of those sites is actually asking: is it ready for real customers?

In short

The Baltic Web Audit detected Lovable, the AI site builder, on 311 production websites: 69 in Latvia, 150 in Estonia and 92 in Lithuania. Whether one of them is production ready is not a question about AI. It comes down to three checks that Lovable’s own documentation describes. Does the site render its pages on the server, or send an empty page to anything Lovable has not verified? Were the database access rules reviewed, or left as generated? Does the code live in a repository the business owns? A site that passes all three is on solid ground. The audit did not open anyone’s code or database, so it cannot say how many of the 311 pass.

How many AI-built sites the Baltics have

The report’s vibe-coded chapter has the counts. Lovable was detected on 69 Latvian, 150 Estonian and 92 Lithuanian sites. Estonia leads in absolute numbers even though its web is smaller than Lithuania’s. These are not previews on a builder’s subdomain. They are live sites on .lv, .ee and .lt addresses, built substantially by a model.

The same chapter counts the design-tool exporters next to them: Framer on 65, 116 and 117 sites in the same country order, and Webflow on 48, 20 and 24. The older no-code layer is bigger and more local. Tilda runs 574 Latvian sites, which makes it the eighth-largest platform in .lv. Mozello, the Latvian company’s builder, runs 89 sites at home against 4 in Estonia and 10 in Lithuania.

Kept in proportion, all of this is small. WordPress alone was detected on 13,048 Latvian, 33,398 Estonian and 37,428 Lithuanian sites. That is roughly one Lovable site for every 190 WordPress sites in Latvia, every 220 in Estonia and every 400 in Lithuania. The report calls it a rounding error, and adds that a rounding error which did not exist two years ago is worth counting. The 311 is a first baseline, and the useful number is what it becomes in the next run.

What Lovable says it is

Lovable describes itself in its documentation index as “a full-stack AI development platform for building, iterating on, and deploying web applications using natural language”. Its hosting and ownership guide says it is “designed to be the easiest, fastest, and most enjoyable way to build production-ready applications”. All the Lovable pages quoted here were read on 28 September 2026.

That claim is about the platform, and the documentation backs a good part of it: server rendering, security scans, access rules on the database, code export. The platform offers all of those. A site uses them only if the person building it did. The same builder can produce a site that is ready and one that is not, and from the outside they look identical. The three checks below are how to tell them apart.

Check one: what a crawler receives

Lovable has used two stacks. Its upgrade guide explains the difference plainly. An older React and Vite app “sends the browser a mostly empty page”, and the visitor’s browser then builds the content with JavaScript. TanStack Start, the newer template, renders each page into finished HTML on the server, so every visitor and every tool receives the same complete page. TanStack Start became the default for new Lovable projects on 13 May 2026.

For the older stack, Lovable fills the gap on its own hosting. According to its SEO documentation, it pre-renders pages on deployed public URLs for a verified list of visitors: Google, Bing, social preview bots, and AI engines such as ChatGPT, Perplexity, Claude and Gemini. Anyone outside that list gets the empty page. In Lovable’s words, “Tools outside that verified list see very little.”

So an older Lovable site is readable by the big search engines and assistants, and blank to everything else: SEO tools, link checkers, smaller engines, and any crawler that appears after the list was written. The audit dates the 311 to July and August 2026, less than four months after the default changed. It did not record which stack each site runs, so we cannot say how many are on which. Any site started before 13 May began on the older stack, unless someone upgraded it.

Upgrading is documented and reversible. The same guide says most upgrades cost 10 to 35 credits, the live site keeps serving the old version until you publish again, and the whole upgrade can be undone from the project’s version history.

Check two: who can read the database

This is the check that matters most, because it is the only one where a mistake leaks someone else’s data. A Lovable app keeps its data in PostgreSQL, and who may read or change each row is decided by row-level security policies. Lovable’s security guide is direct about both halves of it. The browser half: “Frontend code should never make security decisions.” The database half: “Lovable sets up basic RLS policies automatically, but you should review and adjust them early in development.”

“Basic” and “review” are the two words to hold on to. Policies written automatically for a prototype are written for a prototype. Before real customers sign in, Lovable’s own guide asks that row-level security is enabled on every sensitive table, that users cannot reach other users’ private data, that shared data behaves as intended, and that no new table is missing its policies. This is also where the platform’s past trouble sits: CVE-2025-48757, published in May 2025 and scored 9.3, describes an insufficient row-level security policy in Lovable that let unauthenticated attackers read or write the database tables of generated sites. Our look inside AI-generated code covers that route in more depth.

Check three: whose code it is

Lovable’s Git sync page states the default: “your project code is stored and managed inside the Lovable platform.” Git sync connects the project to a GitHub, GitLab or Bitbucket repository you own and keeps both sides in step, and paid plans can also download the codebase. Lovable says it is built so that “you are never locked in”, and the documentation supports that for the code.

Two limits are worth knowing before you rely on it. The editor and the AI agent stay a managed service and cannot be self-hosted. And the backend moves less freely than the code: the supported destinations for Lovable’s built-in backend are managed or self-hosted Supabase, and Lovable’s guide notes that moving the PostgreSQL database alone does not move authentication, storage, realtime or Edge Functions. A business that may one day want a developer outside Lovable to take over should have the repository link in place well before that day.

What you can check yourself, and what needs a developer

Four checks need no developer:

• Ask which stack it is on. Lovable’s upgrade guide suggests typing “What stack is this project on?” into the project chat. If the answer is React and Vite, the upgrade is in project settings.
• Look at what a stranger receives. Open your published homepage and view the page source (Ctrl+U on Windows, Option+Command+U on a Mac). If your headline and your opening paragraph are not in that source, the page is empty to every tool outside Lovable’s verified list.
• Open the access rules. In the project, the policies are under More, then Cloud, then Database, then RLS policies. If nobody has looked at them since the first build, that is the answer to the question.
• Find the repository. In Project settings, the Git tab shows whether the code syncs to a repository, and whose account it is in. It should be the business’s account, not a freelancer’s.

What needs a developer is reading those access rules against the data they protect, moving checks out of the browser and into server-side code, and any move of hosting or backend. That is the work our AI-built websites service is built around, and it starts from the same three checks.

Why we can say any of this

The counts come from the Baltic Web Audit, which measured 293,806 of the 306,872 Baltic domains in its frame in one continuous run over July and August 2026, with every request carrying a user agent that named the study. The full method is in the report. The audit identified the platform behind each site. It did not read any site’s code or database, so nothing here says whether any of the 311 is secure. Everything about how Lovable works is Lovable’s own, quoted from its documentation on 28 September 2026.

If you run a Lovable site and are not sure how it does on the three checks, send us the address and we will tell you what we see before anyone quotes for anything.