Every vibe coding pitch mentions code ownership somewhere in the first paragraph. Export to GitHub. No proprietary format. Take it with you. It sounds like the opposite of lock-in, and for the part of your app that’s just React components, it mostly is.
The part that never makes the pitch is the database. And the database is where the actual app lives.
What “export” really exports
Bolt and Base44 both ship straightforward GitHub sync for the frontend, and Lovable does the same for its React/TypeScript output. If your app is a marketing site or a static prototype, that export is close to the whole thing, and you can hand the repo to a developer and walk away clean.
Business apps aren’t that. The moment your build has logins, roles, and real records, most of what makes it work isn’t in the component tree, it’s in the schema, the auth rules, and the permission logic sitting behind them. That’s exactly the layer these platforms are more reluctant to let go of.
Base44 makes this explicit rather than implicit: reviewers note that front-end code exports to GitHub, but the database and backend stay hosted entirely on Base44’s infrastructure and cannot be directly modified or exported. One Base44 builder trying to get their own files off the platform put it bluntly on Reddit: “I don’t see any src files in the accessible files so I am afraid I would have to pay a year of the builder tier to even get the build off of Base44. That’s $480 which is somewhat ridiculous.” You can technically leave. You pay a subscription first to find out what you’re leaving with.
The Hotel California problem
Lovable’s complaints go a step further, because the issue isn’t just what won’t export, it’s what changes without asking. A Reddit thread that’s become a reference point in the community describes Lovable’s AI autonomously migrating a builder’s private Supabase database to Lovable Cloud, without explicit consent, and titles the platform “a Hotel California for your database: you can check in, but you can never leave.”
That’s a different failure mode than “the export button is missing.” It’s the platform quietly moving the thing you’d need to export in the first place. If you assumed your data lived in your own Supabase project because that’s how the tool markets itself, finding out otherwise after the fact is exactly the kind of surprise that turns into a cautionary Reddit thread other builders find later, right before they make the same assumption.
Base44’s backend lock-in draws the same conclusion from a different angle: a Product Hunt reviewer noted that even where frontend code exports cleanly, the database and backend stay trapped in Base44’s closed infrastructure, preventing true database migration. Two platforms, two mechanisms, the same result: the part of the app that holds your actual business data is the part you can’t easily take with you.
Why this compounds instead of staying flat
None of this matters much on day one, because day one is a demo with sample data. It starts mattering once the app has real users and the schema has grown past what one prompt originally scaffolded.
Schema debt is the mechanism that turns “we’ll migrate eventually” into “we’re stuck.” Long-term Lovable builders report that letting the AI design the database schema works fine at first, but by month six to nine it creates schema debt severe enough that adding a single new field can require rewriting dozens of downstream workflows. At that point migrating isn’t copying a table, it’s untangling a system nobody fully documented while building it. The same research notes experienced builders now advise against Lovable for anything meant to run longer than 18 to 24 months, recommending a move to a code-first stack before that debt compounds further.
Stack that against a platform that also updates itself out from under you. Builders on Lovable describe the platform’s own updates regularly breaking existing client apps, to the point that some now charge clients a monthly maintenance fee just to absorb regressions the platform itself introduced. You’re not just locked into the database. You’re locked into fixing damage the vendor causes while you’re locked in.
“I’m genuinely scared of Base44, because I’m building the foundation of my business on that platform… something works today and then they take it away tomorrow.” - Base44 user, r/Base44
What actually reduces the risk
We’re not going to pretend there’s a version of “hosted platform” that means zero lock-in. Softr is hosted too, and if you close your account, you’re not walking away with a portable app any more than you would from Lovable or Base44. The honest question isn’t “can I avoid lock-in entirely,” it’s “how much of my data stays reachable while I’m still using the platform, and how bad is the exit if I ever need one.”
On that question the mechanism matters more than the marketing line. A few things worth checking before you build something load-bearing on any platform:
- Can an external tool reach your data without going through the app’s UI? Softr’s own database exposes an MCP server (
mcp.softr.io) plus a REST API, so tools like Claude, Cursor, or a script can read, write, or restructure your schema in natural language while you’re still building. Softr frames this directly as preventing lock-in by keeping the database accessible outside a single interface, which is a different promise than “you can export code eventually.” - Does the platform silently move your infrastructure without telling you? This is the Lovable complaint specifically. If your platform can reassign where your data lives as part of an AI action, ask what triggers that and whether you can opt out.
- What does the schema actually cost to change six months in? Not on day one, when everything is a fresh AI scaffold, but after real usage has shaped the data. Schema debt is the slow version of lock-in, and it’s the one that doesn’t show up in a pricing page.
If the app is genuinely a prototype or a personal project, none of this should stop you from vibe coding it this weekend, exportable code and all. But if it’s a client portal, an internal tool, or anything with real users and real records, the Day Two problem and the lock-in problem are the same problem wearing two names: the plumbing you didn’t think about on day one is exactly what’s hardest to move on day two hundred. Check our client portals ranking before you pick a foundation you can’t easily leave.