Building Software Without Coding

In July 2025 Replit’s AI agent deleted a live production database. It had been told, explicitly and repeatedly, that there was a code freeze. It then generated 4,000 fake user records to cover up what it had done, and told the founder that a rollback was impossible. It wasn’t. Replit’s chief executive publicly apologised, and the incident is logged in the AI Incident Database as case 1152.

We are opening with that not to be dramatic but because it is the clearest single illustration of the gap between what these tools can do and what they can be trusted with and because the earnings story turns out to be much weaker than the failure story is strong.

The short version, before the detail: “anyone can build an app with AI” holds up. “Anyone can build an app and earn a living from it” does not. We went looking for a verified case of a person with no technical or startup background earning a real, checkable income from an app they built this way. We did not find one.

What you can build#

This part is real and worth taking seriously. With Lovable, Bolt, Replit, v0, Claude Code, Cursor or Base44, someone who cannot write code can produce a working thing in hours: a CRUD app, an internal dashboard, a prototype, a simple consumer app with login and Stripe payments, a landing page, a directory, a wrapper around a language model.

Where it stops working is documented rather than theoretical. MIT Technology Review’s reporting puts it plainly: these tools “struggle to parse large code bases and are prone to forgetting what they’re doing on longer tasks”, and the errors are hard to spot because the output looks finished. Every incident below has that profile.

What the tools cost#

Every one of those prices is a floor, not a ceiling. All of them bill by consumption, so the advertised figure is what you pay if you barely use it. Replit says so directly: active daily use can add $5–20 a day on top of the subscription. Independent write-ups of Lovable put real spend at two to three times the sticker price. And Base44’s credit value fell 15–30% after the Wix acquisition while its free tier shrank from 100 messages to 25, a useful reminder that the terms you sign up on are not the terms you keep.

The earnings evidence, and why it falls apart#

There is enormous money here. It is going to the tool companies.

Lovable’s self-reported annual recurring revenue went from $100 million in July 2025 to over $400 million by March 2026, on 146 staff, and it raised $330 million at a $6.6 billion valuation. Base44 sold to Wix for around $80 million in cash six months after launching. Those are real, reported numbers and they are evidence that selling shovels works, not that digging pays.

The two success stories everyone cites#

Cal AI is the calorie-tracking app that reportedly earns $30–40 million a year and was acquired by MyFitnessPal in March 2026. It appears in every “vibe coding made him rich” listicle. Its founder went to a coding camp at seven, taught himself Python and C# from YouTube through middle school, and was beating university students at hackathons at twelve. That is a skilled programmer’s success story wearing a non-programmer’s clothes.

Base44’s founder learned to code later in life but had already co-founded a venture-backed data analytics company before starting it. Not a first-timer.

Anything, the 2026 entrant that hit $2 million in annual revenue in two weeks and raised at a $100 million valuation, was founded by ex-Google engineers.

Three for three. Every headline case, traced to its primary source, involves someone who was not starting from zero. Not a coincidence: it is the shape of survivorship bias, and the marketing is built on it.

What exists instead of data#

Self-reported figures from indie-builder communities suggest a steep power law: roughly 40% of people who publish numbers are under $1,000 a month, about 35% between $1,000 and $5,000 and only 8–10% above $10,000. Those figures come from sites that cite each other rather than any traceable survey, with no disclosed sample or method, and, critically, the population includes experienced developers rather than isolating non-programmers using AI.

So the most defensible statement available is: most self-published indie projects earn very little, a minority earn a real income, and how non-programmers specifically perform inside that distribution has not been measured by anyone. Anybody quoting you a precise success rate is making it up.

Vendor pricing pages and press reporting. The indie-income spread is self-reported. Sources: its own blog, TechCrunch, Bloomberg, TechCrunch, CNBC, MIT Technology Review.

The security data is the strongest evidence here#

This is where the research is rigorous, and it is uniformly bad news for software nobody technical has reviewed.

Veracode’s 2026 report found that about 44% of AI code-generation tasks introduced a security vulnerability. The average cross-model security pass rate was 56%, barely moved from 55% the year before. The best model managed 68%. On SQL injection specifically, the failure rate was 83%.

Georgia Tech researchers scanned more than 43,000 public security advisories and traced bugs to their origin, confirming 74 vulnerabilities attributable to AI, 14 critical, 25 high. The pace is what alarms them: 18 cases across the second half of 2025, then 56 in the first quarter of 2026 alone, 35 of them in March.

GitGuardian found 29 million new hardcoded secrets in public GitHub during 2025, up 34%, and, the relevant number. AI-assisted commits leak credentials at roughly twice the site-wide rate.

Peer-reviewed research presented at USENIX Security 2025 generated 2.23 million code samples across 16 models and found 19.7% referenced a package that does not exist. That matters directly to a non-coder: an attacker registers the hallucinated package name, and anyone who runs the install command the AI suggested downloads malicious code. It has a name now, slopsquatting.

What that looks like when it happens to a real app#

Lovable, CVE-2025-48757, severity 9.3 out of 10: the default database configuration it generated was missing row-level security, which meant anyone could read and write across 170+ live production apps — names, emails, payment records, API keys, using the public key sitting in the page source.

Moltbook, launched 28 January 2026 by a founder who publicly said he “didn’t write one line of code”. Security firm Wiz found a misconfigured database with no row-level security and a hardcoded public key, exposing 1.5 million API tokens, 35,000 email addresses and private messages. Fixed within hours of disclosure, after launch, by strangers.

One clarification, because it matters for honesty: the Tea app breaches of July 2025 are constantly cited as a vibe-coding disaster. The breaches were real. Whether the app was built that way is not confirmed and we are not going to use it as evidence.

Sources: Veracode’s 2026 GenAI Code Security Report, Georgia Tech Research, GitGuardian’s State of Secrets Sprawl 2026, as reported by Socket, Matt Palmer’s CVE write-up, Wiz Research on Moltbook, AI Incident Database #1152.

The productivity finding nobody wants#

METR, a nonprofit research group, ran a randomised controlled trial with 16 experienced open-source developers working on real tasks in codebases they knew well, with and without AI assistance.

They were 19% slower with the AI. And both before and after, they believed they had been about 20% faster.

That study is about skilled developers in complex existing code, not beginners on a blank page, so it does not transfer directly and we are not claiming it does. What it does establish, rigorously, is that the feeling of speed these tools produce is not reliable evidence of speed. Hold onto that when you are three weekends into something that feels nearly done.

What the evidence supports paying for#

Given all of the above, here is what the evidence supports, in descending order.

Building internal tools for a small business, as paid work. Plausible, low-risk, and the same demand described in automations for small businesses. A client portal, a tracker, an internal dashboard. Nobody has measured what this pays, but the businesses exist and have budgets.

Selling templates and starter kits. The clearest earnings trail of anything here, and it is modest: templates go for $5–50, Lovable-specific starter kits $99–299, and sellers with a catalogue of 10–15 products reportedly reach $500–2,000 a month after six to twelve months. All of those specific figures are aggregator-sourced, so treat them as the shape rather than the number.

Fixing other people’s broken AI-built apps. This is a business now, there are multiple independent agencies competing on it, which is the strongest possible evidence that demand is real. It is also skilled technical work, so it is a route for people who can already code to earn from this wave, not a route for beginners.

Building a micro-SaaS to real recurring revenue. It happens. It is a minority outcome, indistinguishable in the data from ordinary bootstrapped-startup base rates, and confounded throughout by founder skill that nobody is measuring.

And if you want to sell the thing you built#

The marketplaces are real: Flippa’s micro-SaaS sweet spot is $100,000–500,000 with an average deal around $323,000 and multiples of 2.5–4.5 times profit; Acquire.com’s median profit multiple was 3.9 across both 2024 and 2025. Smaller projects trade on SideProjectors, Transferslot and Indiemaker and 1Kprojects exists specifically for things selling under $1,000.

Two cautions. Those headline prices describe established businesses with real customers and revenue, not weekend projects. And AI tools specifically trade at a discount — one to two and a half times profit, because buyers know how easily they can be cloned.

What this costs when it works#

Worth budgeting honestly. The subscription is $20–25. Then, somewhere around month three to six, real applications acquire real costs: transactional email, logging, image processing, background jobs, each $20–100 a month. Independent write-ups put realistic all-in first-year cost at $2,000–15,000 once overages, security remediation and rework are counted.

The failure mode nobody plans for is an app with users, no revenue and a monthly bill. That is a worse position than never having built it.

So should you do it?#

Build things, yes, absolutely. Build internal tools, build the thing that solves your own problem, build a prototype to show a client. It is a new capability and it is cheap.

Build a business on it as a beginner, go in with your eyes open. There is no evidence base for it, the base case is a project that earns nothing, and if it does get users you are responsible for their data with no ability to assess whether you have protected it.

If you ship something with real users, get the security reviewed by someone who can read the code. One paid hour of a developer’s time on row-level security and secret management is the cheapest insurance in this entire section. Every named incident above was that exact failure.

And do not put anything you cannot afford to leak in it. Not payment details, not health information, not anything about children. If the app needs those, it needs a professional.

Who this suits#

People who want to solve their own problems and are not trying to earn from it directly. People who already have a client relationship and want to deliver more. People who can code a bit and want to move faster. And people who want to sell templates, which is the modest, honest version.

Who it does not#

Anyone whose plan is to build an app and live off it, on the current evidence. Anyone who cannot get the security reviewed and intends to handle other people’s data anyway. Anyone who will not notice a rising monthly bill. And anyone who needs the money soon — the automation route uses overlapping skills, has documented rates, and pays for the first job.

This is a fast-moving area and the security picture in particular is being actively researched, if you have measured data on non-programmer earnings here, we want to see it: [email protected].