In recent weeks, I’ve been researching Replit Agent 3, Google Jules, and OpenAI Codex.

I try to avoid hype and stay realistic about what AI can (and can’t) do today. But here I have to admit: the progress in no-coding is crazy. What used to take 2–3 sprints (2 weeks each) can now be done in just 1–2 days.

For example, I recently decided to add video courses to Accredia to replace Kajabi (~$200/month). After only 6 hours, I’m already testing the solution.

At the same time, I realized that vibe-coding is not enough. To build with AI, you don’t need to code. But you do need basic engineering skills.

Here’s how I see the difference:

Share

Luckily, it’s not rocket science.

In this special post I summarize all key resources.

From now on, all posts related to Building SaaS with AI will be published in a dedicated section. I’ve already migrated the old content there.

The Best Free Resources

Those resources cover all the basics. You need to understand just enough to prompt and challenge coding agents:

• System Design 101 by ByteByteGo (GitHub)

• Engineering Visual Guides

• Become a Supabase Pro in 1.5 Hours (1:26:39)

• Overview of HTTP (MDN)

• HTTP Request Methods (MDN)

• Node.js + Express.js in 17 Minutes

• Every React Concept Explained in 12 Minutes

• TypeScript Basics in 12 Minutes

• CSP Guide (MDN)

• OWASP Top 10

• Getting Started with Lovable

• Replit AI Agent Full Course (2:08:45)

• n8n Masterclass (2:10:35)

• How to Integrate Supabase with Clerk

Guides for Those Building AI-Powered Products

Essential resources for AI product builders: AI strategy, evals, and security:

• AI Product Strategy

• 14 Prompting Techniques

• AI Evals

• Error Analysis

• Context Engineering

• AI Agent Architectures

• 17 Penetration & Performance Testing Prompts

• 3-Layer AI Distribution Framework

How to Learn by Doing

Practical examples. No coding, just tech understanding:

• LLM Chatbot

• RAG Chatbot

• Voice Agent

• Multi-Agent Research System

• Separate DEV/TEST/PROD

• Full-Stack App with Lovable (2:00:00)

My Favorite Tools for Vibe Engineers

• Database: Supabase

• Vector store: Pinecone

• Coding agents: Lovable (easiest), Replit, Cursor, OpenAI Codex (most advanced)

• Hosting: Netlify, Vercel

• Authentication: Clerk

• Hardening: Cloudflare

• Transactional emails (avoid SPAM): Postmark

• SEO for SPA apps: Prerender

• Cache: Redis + Netlify

• Storage: S3

• Analytics: Clarity, PostHog

• Logging: Logtail

• Metrics: Grafana

• Feature flagging: GrowthBook

• System status: Uptimerobot

• Payments: Stripe

• Agentic workflows: n8n (easiest), LangChain (most advanced)

• Evals off-the-shelf: LangSmith

Next, we’ll cover:

• A practical step-by-step evals guide anyone can repeat + eval vendors comparison

• Next week we’ll finalize C10:LLM Systems Practitioner PM from the AI PM Learning Program by adding:

  • Advanced fine-tuning techniques

  • n8n LLM workflows to automate your work

Subscribe now

Every week, I share actionable insights and resources for AI PMs.

Consider joining the community of 121K+ and upgrading your account for the full experience:

Subscribe now

The recent posts were published without a paywall or with huge free sections. This time, we’re prioritizing a premium experience.

In today’s post:

1. Accredia: Status, Security Challenge, and the $4,500 Winners

2. 🔒17 Penetration & Performance Testing Prompts for Vibe Coders

   1. Group 1: Six Prompts to Reverse-Engineer and Document Your App

   2. Group 2: Custom Instructions / Project Knowledge

   3. Group 3: Seven Powerful Prompts to Stress-Test Security

   4. Group 4: Three Prompts To Boost Performance

3. Vibe Coding Security & Performance: 13 Essential Tools And Resources

4. Conclusions

Let's dive in.

1. Accredia: Status, Security Challenge, and the $4,500 Winners

Product Status

I’m back from vacation and continuing work on my no-code B2B2C SaaS PoC.

Accredia is live. I’ve migrated certificates for all three video courses: Product Discovery, Strategy, and Innovation.

My public profile: https://www.accredia.io/users/pawel-huryn

Next:

1. If you earned a certificate, you should have received a notification. Sign up using your email address.

2. I’ve started onboarding the first two organizations. I hope to learn a lot! 🙂

3. This is just a PoC, but I’m going to try to win the first beachhead segment.

I’m also creating a simple, ready-to-use template to help anyone vibe-code a production-ready side project. I realized this will require covering the basics like Supabase or Clerk, and we’ll get into that too.

In the next few posts, we’ll focus more on Strategy, Discovery, and AI PM topics.

Security Challenge and the $4,500 Winners

Before importing real student data, I used AI to audit security and permissions. Then, organized a public security challenge on LinkedIn and Reddit and promised the first three people to hack the platform to win $1,500 each.

Over 80+ developers created student accounts to hack the app. I received 12+ detailed reports and rewarded three people:

• William LE POMMELET: XSS vulnerability for 3 fields (a real issue I had missed; this would allow attackers to target visitors of a specific public profile)

• u/wrighte0: CSP issues (impossible to leverage right now, but essential to cover).

• Vinicius Lage: A theoretical vector of attack using a Clerk token from another instance (impossible to leverage right now, but too important to ignore).

I learned a lot. Thanks to those and other reports, including reverse-engineering failed attack attempts documented by participants, the framework has become stronger than ever 🙏

2. 17 Penetration & Performance Testing Prompts for Vibe Coders

Based on the recent experience, I’ve refined a set of prompts that will help you:

1. Understand your system, its architecture, and components.

2. Identify common mistakes, best practices, and areas for improvement.

3. Detect possible attack vectors, critical vulnerabilities, and future improvements.

4. Boost the performance of your product as it scales by addressing typical issues.

Notes:

• The prompts are not Lovable-specific. They will work with Cursor, Replit, etc., too.

• If you work with Lovable, make sure you’re using the Agent Mode.

Group 1: Six Prompts to Reverse-Engineer and Document Your App

First, we need to document the system. This will help us detect the first critical issues and create the foundation for future work.

Prompts available in the Notion collection:

After major changes, adjust the prompts and run them again to update the existing documentation by starting with:

“Think step-by-step. Reverse-engineer the codebase to update [the rest of the prompt].”

Example result 1: System Architecture Documentation

See the full file on GitHub

Note that I didn't address all suggestions in the first iteration - I talked with an agent through the consequences and mitigations to learn fast and responsibly. The final reusable template will include additional suggestions.

Example 2: Roles and Permissions Documentation

Example 3: Scheduled Work Documentation

Group 2: Custom Instructions

Documenting your system was the first step. Next, we need to make sure the coding agent can easily find that information.

The best way is to reference these documents in the custom instructions attached to each user prompt.

In Lovable, they're called “project knowledge.” Many coding agents support the OpenAI's AGENTS.md format.

A ready to use template from the Notion collection:

Group 3: Seven Powerful Prompts to Stress-Test Security and Permissions

Those are the prompts that will challenge your app the most. Surprisingly, I get much better results when persuading the AI that someone has already hacked the app.

Prompts available in the Notion collection:

Group 4: Three Prompts To Boost Performance

The last three prompts cover the most common performance issues:

The Premium Notion Collection Also Contains

Our Notion collection is growing fast and also contains:

Get Access By Clicking The Link Below

The prompts are way too long for this post.

Please use the link below:

Read more

Yet, people:

• Claim it’s just a prototyping tool

• Call it “vibe-coding” (I’m allergic to the term)

• Insist you need engineers to build real products

So, I decided to continue my PoC, and today I’m launching my first real SaaS.

My goals:

• Prove it’s possible. You do not need to code

• Demonstrate and explain the next steps, like GTM and getting the first customers

You can use the same techniques to:

• Create a new product or clone an existing product like Typeform or DocuSign (standard digital signatures - enough for most US companies)

• Create an extra revenue stream.

• Become the Product Manager of your product without asking for permission

In this post:

1. Accredia: A Certificate Management Platform

2. No-Code SaaS Secure Solution Architecture

3. 🔒 Three Lovable Prompts You Can Reuse to Start Building

4. 🔒 What’s Next and Conclusion

Hey, Pawel here. I’m on vacation 10-21 August, but our posts will not be disturbed.

We will be discussing launching apps in detail during office hours after my return.

Consider subscribing and upgrading your account for the full experience:

Subscribe now

1. Accredia: A Certificate Management Platform

Accredia allows anyone to easily issue, receive, and share digital credentials.

Why credentials, not a sexier app like Dropbox, DocuSign, or Typeform?

I started with a problem I knew: existing digital certificate solutions are too expensive for many product, Agile, and tech trainers.

For example:

• Accredible: ~$960 for 1,000 certificates (my deal)

• Credly: ~$5,000 for 1,000 badges

Accredia already provides 80% of Accredible’s value. A short demo:

In the first version:

• Multiple organizations can use the platform simultaneously

• Each organization can invite multiple users (Admins, Members)

• Administrators can:

  • Define and manage courses

  • Use a drag & drop certificate editor

  • Issue certificates manually or using a spreadsheet

  • Manage organization members

  • Manage the organization’s subscription, make payments, download invoices

• Students can:

  • Edit their public profiles (including the URL)

  • Publish/unpublish their learning profiles and certificates

  • Generate shareable links for social media

• Unauthenticated users can:

  • Visit public student profiles

  • Verify whether a public certificate is authentic

Building this took me just ~16 hours, 340 Lovable credits, and $80. If we continue, after another 16-24 hours, we’ll achieve feature parity (better social previews, integrated social platform sharing).

Why would anyone pay for Accredible?

Next:

• I’m starting to migrate a few thousand of our certificates from Accredible. I hope people will share them; a growth loop for the platform and for organizations.

• Accredia is free for up to 1,000 certificates/year for all premium subscribers. Others cover basic infrastructure costs. If you have students, email me at pawel@productcompass.pm to join the beta.

• GTM: Social media + SEO: “alternatives to X,” “X vs. Y,” and similar. I’ll leverage my high-domain-authority site (productcompass.pm).

• Trying to win the first Beachhead Segment.

[Edited]

I highly recommend those feature and price comparison pages of digital certificates and digital credentials solutions:

• The #1 Kajabi Alternative: Video Courses, Digital Credentials

• The #1 Credly Alternative: Certificate Management, Digital Credentials

• The #1 Accredible Alternative: Stop Paying for Your First 1,000 Recipients

2. No-Code SaaS Secure Solution Architecture

All components here are universal.

Separated Environments

I separated my DEV, TEST, and PROD environments using the advice from the previous post: How to Build and Scale Full-Stack Apps in Lovable Without Breaking Production

Quality Assurance in Lovable

I start with things that don’t scale to verify assumptions. I’ve defined a manual test scenario checklist before release.

The next step will be recording test scenarios in the browser with Selenium. This “black-box” testing will cover all my needs for now.

Status Monitoring in Lovable

I will use a free UptimeRobot service on production for monitoring and communication.

An example for aigents.pm:

Extended Product Analytics - Heatmaps And Session Recordings in Lovable

I’ll start with free Microsoft Clarity for heatmaps/session recordings, while masking sensitive data. This helps me understand behavior patterns and what users might struggle with. I’ll follow up with interviews.

An example for aigents.pm:

Multi-Tenant Setup in Lovable

I used Clerk that provides authentication (e.g., Google, email), organizations, users, roles, and subscriptions. Clerk also supports MFA, invitation emails, and feature toggles.

With Lovable, all I needed was to add predefined Clerk components:

• <OrganizationSwitcher /> - switch between an organization / personal profile

• <UserButton /> - manage account, sign out

• <OrganizationProfile /> - manage organization, members, billing, and invoices

Lovable wired them up correctly on the first try.

Secure Architecture & Advanced Permissions in Lovable

I didn’t code. I asked Lovable to use Clerk and it iterated from there.

This architecture is backend-first using Clerk for authentication and Supabase Edge Functions for authorization.

Key assumptions:

• Authentication: Clerk manages login/logout and session lifecycle.

• Authorization: Roles from the Clerk v2 JWT (`admin`, `user`) are enforced server-side in Edge Functions.

• Database Security: RLS enabled; only Edge Functions (service role) access the DB.

• API Security: Tokens validated, scoped by organization, actions gated by user role.

• Critical: We use the Clerk Backend API to avoid malicious actors forging tokens.

Why this approach?

I could have integrated Clerk with Supabase to use standard Supabase RLS (row-level security) and let the frontend access Supabase directly. But for production products, you need robust, fine-grained backend control so that, for example:

• Student emails aren’t exposed in public views.

• Organization members (not admins) can edit only selected certificate fields.

Benefits:

• No direct DB access

• Centralized authorization

• Auditable logs (all operations logged in Edge Function logs)

• Full control over the business logic and permissions (row- and column-level)

Share

3. Three Lovable Prompts You Can Reuse to Start Building

In this chapter, I provide three exact prompts you can easily use to get the same results without effort.

On top of that, we will be discussing launching apps in detail during office hours after my return. And premium subscribers also get my full support on Slack.

How technical should you be?

No coding is required or necessary. At the same time, it’s fair to say you need to:

• Understand the architecture

• Know what JSON, CSS, or HTML are

• Feel comfortable reviewing simple SQL queries or 2–3 lines of code snippets

• Know how to inspect a website in the Google Chrome console (aka DevTools)

I don’t really know React or TypeScript (never used them), and I don’t code when working on my Lovable projects.

Step 1: Document architecture in readme.md

For a new project, ask Lovable to document the architecture in readme.md. Otherwise, it will keep making the same mistakes over and over again:

Read more

Every week, I share actionable tips, resources, and insights for PMs.

Here’s what you might have missed recently:

1. I Copied the Multi-Agent Research System by Anthropic. No Coding!

2. The Ultimate AI PM Learning Roadmap

3. Introduction to AI Product Management

Consider subscribing and upgrading your account, if you haven’t already, for the full experience:

Subscribe now

For months, I’ve been repeating that Lovable is the best solution for building real full-stack apps. No coding.

In How to Quickly Build SaaS Products With AI we discussed the best practices of working with Lovable. In A Complete Course: How to Build a Full-Stack App with Lovable, I shared a 2-hour, step-by-step walkthrough.

But I haven’t addressed one critical question:

How do you keep building your app while real users are using it in production?

Any code or database change can break your app. That’s why the first step in Lovable must be branching and separating environments.

In traditional products, a common setup is:

• (Local) - local engineer’s environment

• DEV - environment shared by engineers

• TEST - environment meant for testing

• STAGE - staging environment with configuration and data mimicking production

• PROD - production environment used by real users

When vibe coding, you might not need that complexity. A better approach might be:

But I recommend starting with the simplest possible setup to make sure your ongoing work doesn’t affect production:

Lovable’s website didn’t provide enough information, I faced many errors, and the available options were confusing.

So, after weeks of research, I’m sharing my tested approach in detail, with step-by-step instructions. As always, no coding:

1. Lovable Branching: How to Separate DEV and PROD Environments

2. How to Move Changes Between The Environments

3. How to Add TEST and Other Environments in Lovable

4. How to Roll Back Changes if Something Goes Wrong

This post is meant for people who want to quickly build and scale real products without coding and without breaking production.

If you're just experimenting with MVPs or prototypes without paying customers, feel free to skip it and check out other AI Product Management issues.

P.S. And in one of the next posts I’ll demonstrate plugging automatic tests.

1. Lovable Branching: How to Separate DEV and PROD Environments

As part of my no-code SaaS PoC, I’m developing a credentials management app using Lovable. It will replace Accredible (from $996/year).

In 12 hours, I implemented:

• Multi-tenant B2B SaaS

• Admin and member roles for each organization

• Google & email authentication

• Drag & drop certificate editor

• Downloading certificates as PDFs and images

• Payments

I wanted to share it with coaches to get their feedback. But I planned a few significant changes that might break the app.

I knew I needed to separate and manage:

• Source code

• Supabase database

• Web app hosting

Here’s how I separated my PROD and DEV environments:

Step 1: Create a new ‘dev’ GitHub branch in Lovable

Lovable supports 2-way sync with GitHub, which can store the code and its modification history.

To isolate the environments, we need to create a copy of the default “main” (PROD) branch in a way that will allow us to migrate our changes between the environments, for example DEV > PROD:

1. Open your project in Lovable and click the GitHub icon. Enable GitHub integration if you haven’t already.

2. Next, click the “main” branch and create a new “dev” branch:

The result: When you edit your app in Lovable, code changes will be saved in a ‘dev’ GitHub branch without affecting the ‘main’ production branch.

Step 2: Create a new Supabase database

We also need a new Supabase instance. To create it:

1. Log in to your Supabase dashboard. You can find the link in the right upper corner of Lovable.

2. Next, create a new database for DEV environment. I called it “dev-certificates:”

(I didn’t use Supabase branching because deployments on a DEV environment are managed by Lovable. I wanted to fully isolate it from the other environments.)

The result: An empty database for the DEV environment.

Step 3: Switch Lovable to the new Supabase

Wait a few minutes. Once the new database is created:

1. Open your project in Lovable and click the Supabase icon

2. Switch the database (in my case, “dev-certificates”)

The result: When you change data structure or backend functions in Lovable (tables, edge functions, RLS policies), it will try to deploy those changes to the DEV Supabase, without affecting the PROD.

Step 4: Ask Lovable to run SQL migrations

The database we created in point 2 is empty and has no objects, such as tables.

Ask Lovable to execute the SQL migration scripts in order to get the same database structure. I suggest the following prompt:

Execute existing Supabase migrations without creating new migration files by:

- Taking the SQL content from your migration files

- Running it through the lov-sql block for me to review and approve

If migrations don’t exist, create a new SQL migration file first.

(We could also execute those migrations manually or through Supabase CLI. I wanted to maximally simplify the process.)

The result: Your DEV environment has the same SQL tables, SQL functions, storage, and RLS policies as PROD. Future updates will be managed by Lovable.

Step 5: Ask Lovable to redeploy edge functions

Edge functions contain your business logic. They are deployed differently and were not included in SQL migrations.

Ask Lovable in the Chat Mode to:

Can you re-deploy all existing edge functions?

Next, click “Implement the plan” if Lovable hasn’t deployed them automatically.

I didn’t need it, still, I repeated the process to generate screenshots:

(We could also execute those migrations manually or through Supabase CLI. I wanted to maximally simplify the process.)

The result: Your DEV environment has the same edge functions as PROD. Future updates will be managed by Lovable.

Step 6: (Optional) Add Supabase secrets

If you’re using integrations like OpenAI or Clerk, their API keys are likely stored as Supabase secrets and have not been added to a new Supabase.

The simplest approach is to copy them manually:

(Note that some API keys might be different depending on the environment. For example, you might want to use a different Clerk instance for DEV and PROD.)

The result: Your DEV environment has the right Supabase secrets.

Share

Step 7: Fix hardcoded IDs

Even though we theoretically connected Lovable to the new Supabase project, in some cases, Lovable hardcodes the old project ID, e.g. in the edge functions.

In that case, your app will still display data from PROD :)

You can get your project ID from the Supabase dashboard:

Next, ask Lovable (use your project IDs and the Chat Mode):

I get the impression that somewhere in the code we still have the old Supabase connected or we might be using the old endpoints. Make sure we're connected to project ID etblqdmkutnigpoeeiha (the current ID) and we do not use awosmozntgjdxxfumewh (the old ID).

It turned out the old project ID was hardcoded in multiple places, so rather than accepting the plan, I asked Lovable:

Can't you move it to one place?

And only then clicked “Implement the Plan:”

The DEV environment stopped displaying data from PROD. I was able to create a new course without seeing the previous courses:

The result: Your DEV environment is fully connected to a new Supabase project.

Step 8: How I fixed hardcoded project IDs in the main (PROD) branch

What about the ‘main’ branch? After all, project IDs were hardcoded there, too.

I didn’t have to fix it, as the hardcoded values were correct. But I coudln’t sleep well at night if I didn’t fix it.

I used standard GitHub features:

1. Create a pull request from “dev” to “main”

2. Merge changes from “dev” to “main” while fixing project ID

I had to change my custom file containing project ID (from Step 7):

src/lib/constants.ts

When using standard Supabase policies, you might have to change this Lovable file containing project ID and Supabase publishable key. Just in case, verify its content:

src/integrations/supabase/client.ts

Step 9: Enable automatic deployments for PROD Supabase

Whenever we use GitHub to move a new feature from ‘dev’ to ‘main’ (DEV > PROD), we want those changes to be automatically deployed to PROD Supabase.

Go to your Supabase dashboard:

1. Select the PROD database \ Integrations

2. Connect Supabase to your GitHub repository

3. Leave “.” as Supabase directory (Lovable’s default)

4. Enable automatic deployments to PROD from the “main” branch

5. Disable automatic branching

6. Save changes

The result: When you merge changes to the “main” GitHub branch, Supabase will automatically run SQL migration scripts and redeploy edge functions.

You can later review the logs of those operations here:

Step 10: Host and automatically deploy UI on PROD

Finally, we need to host UI for PROD. For that, I used a free Netlify account.

All you need to do is to create a new Netlify project and connect it to your GitHub “main” branch:

That way, I get two different apps:

• DEV hosted by Lovable (one student certificate visible in the recording above)

• PROD hosted by Netlify (two student certificates visible in the recording above)

The result: When you merge your changes to the “main” GitHub branch, Netlify will automatically rebuild the front end and host a new UI. You can also easily connect a custom domain in Netlify configuration.

Share

2. How to Move Changes Between The Environments

Important prerequisites

Before moving forward, you must instruct Lovable that from now on, each migration script should follow the following format required by Supabase:

## SQL migration file names

All new migration scripts should follow the following format: <timestamp>_name.sql

Example: 20250706150015_add_earning_criteria.sql

You can add this information to project knowledge in Lovable:

Migrations troubleshooting

If, like me, you did a mistake of renaming old migrations, Supabase won’t migrate anything. In that and similar cases:

• Execute delete from supabase_migrations.schema_migrations in Supabase to clean a migration history:

  

• Move old migration files to the archive, e.g., to a separate folder using GitHub Desktop or remove them from the main branch (in that second scenario, make sure you know what you’re doing). That way, those files will be skipped (Lovable doesn’t create them in a way that you can execute them multiple times):

  

How to move changes between the environments

Below, I recorded a video in which:

1. I asked Lovable to add a new field “Earning Criteria” to the course form. This changes the code and SQL database (a new column “earning_criteria”).

2. After testing, I created a pull request from dev to main (PROD) in GitHub and merged it.

3. Supabase detected a new migration file and updated the PROD database.

4. Netlify detected a GitHub change and deployed a new front end.

(No voice, I’m still recovering after being sick this week. But I added descriptions.)

3. How to Add TEST and Other Environments

This process is way easier. We do not have to deal with Lovable anymore.

Step A: Create a new GitHub branch from ‘main’ e.g., ‘test’

You can use GitHub UI:

The result: You have a new GitHub branch for the new environment.

Step B: Go to Supabase and create a new branch, e.g., ‘test’

Sync it with the GitHub branch you’ve created:

The result: You have a new Supabase branch for the new environment. All database changes will be deployed automatically.

Step C: Repeat steps from the previous point

• Step 6: Add Supabase secrets (if applicable)

• Manually edit project ID and Supabase publishable key as explained in Step 8

• Step 10: Host and automatically deploy UI on PROD (Netlify)

After completing those steps, you have three isolated environments: DEV, TEST, PROD.

The result: When you merge your changes to the “main” or “test” GitHub branch (DEV > TEST), the Supabase is automatically updated. Netlify will automatically rebuild the front end and host a new UI.

4. How to Roll Back Changes if Something Goes Wrong

Despite testing, sometimes things break. In that case:

Revert GitHub

You can view repository at the time of a specific commit and download files manually:

Another option is reverting the most recent pull request:

Restoring GitHub to any point in time is outside the scope of this post and might require running git console commands, e.g., to create a temporary branch based on a working commit ID.

Restore Supabase

If your database was modified, you might need to restore it from a backup.

Ideally, you can restore your Supabase to a selected point in time. But it costs $100/month with a 7-day backup period:

At minimum enable daily backups and plan larger deployments just after a new backup is created. This feature is available in the cheapest $10/month plan:

Thanks for Reading The Product Compass Newsletter

I wanted to share this for those who, like me, use Lovable to build real full-stack apps.

On Tuesday, I’ll demonstrate a practical example of creating DEV and TEST environments for a simple Lovable project during our office hours. The recording will be, as always, available here.

In the coming weeks, I’ll demonstrate (no coding):

• Plug in unit testing to your CI/CD pipeline

• Build a multi-tenant B2B SaaS with payments (my PoC resumed)

• GTM to get real users (my PoC continued)

Get 20% off a group subscription

Have an awesome rest of the week and a fantastic week ahead!

Paweł

Every week, I share actionable tips, resources, and insights for PMs.

Here’s what you might have recently missed:

1. I Copied the Multi-Agent Research System by Anthropic. No Coding!

2. What is an AI Agent, How to Build an AI Agent

3. The Ultimate AI PM Learning Roadmap

4. AI Agent Architectures: The Ultimate Guide With n8n Examples

5. Introduction to AI Product Management

Consider subscribing and upgrading your account, if you haven’t already, for the full experience:

Subscribe now

Since Jan 2025, I’ve been promoting Lovable as the best no-code solution for building real, full-stack apps. In that time, the company has grown about 10 times from $6M to $60M ARR, becoming Europe’s fastest-growing AI startup.

But I’ve also emphasized one thing:
While working with Lovable doesn’t require coding, it does require basic technical knowledge.

As explained in best practices, a Lovable user should:

• Review components Lovable creates,

• Look at the database structure,

• Understand Supabase RLS (row-level security) policies,

• Know how to integrate Lovable with GitHub, Supabase, or Netlify.

Turned out, it was a problem for some readers.

Recently, someone in our community recommended Base44. I was skeptical. But I decided to test it.

Base44 turned out to be the simplest all-in-one solution for those who want to build prototypes, small full-stack apps, or even minimal products.

So, in today’s issue:

1. Demo: Building a RAG Chatbot With Base44

2. Base44 vs. Lovable: Feature Comparison

3. Conclusion

This post was not sponsored. The only sponsors that appeared here on Substack in 2025:

• AI PM Certification by (Product Lead at OpenAI). I recently joined Miqdaq as AI Labs Build Leader.

• AI Evals for Engineers and PMs by (ML Engineer, 25 years of experience) and Shreya Shankar.

Those courses are currently the #1 and #2 ranked on Maven.

1. Demo: Building a RAG Chatbot With Base44

In 18 minutes, I built a RAG chatbot and recorded the entire process.

A full recording with everything I did step-by-step:

Read more

Every week, I share actionable tips, templates, resources, and insights for PMs.

This is the #1 AI PM newsletter for those who want to quickly learn by doing rather than listening or studying theory. No coding.

Here’s what you might have recently missed:

• AI Agent Architectures: The Ultimate Guide With n8n Examples

• The Ultimate ChatGPT Prompts Library for Product Managers

• Introduction to AI Product Management

Consider subscribing or upgrading your account for the full experience:

Subscribe now

Recently, everyone is talking about vibe coding.

I never liked the term. Every time I hear it, I think about people demonstrating stunning 3D games and prototypes.

But something is missing: They struggle to go to market and monetize apps.

What most people do is:

• Launch a free product and delay monetization (no skin-in-the-game)

• Some add external links (limited to products like a marketplace)

That needs to change.

I’m sharing a free Lovable B2C SaaS template integrated with Stripe you can use as a starting point to:

• Quickly build and monetize real products without coding

• Build a portfolio just a few AI PMs have

• Get practical GTM experience

To demonstrate how the template works, I build a simple app to manage to-dos:

Demo of a user making Stripe payments and managing a subscription step-by-step:

In the next weeks, I will cover go-to-market, customer support, renewals, and release management. I will also present building an app to manage course certificates and get a few real customers as a PoC. Using the template to build the first app was already a lot for a single post.

In this issue:

1. How to Use Lovable B2C SaaS Template

   1. Step 1: Clone my template

   2. Step 2: Connect Supabase

   3. Step 3: Run database migration scripts

   4. Step 4: Connect GitHub

   5. Step 5: Connect and configure Stripe automatically

   6. Video With Steps 1-5

2. 🔒 How to Create a Custom B2B SaaS Product

   1. Step 6: Modify content, look, and feel

   2. Step 7: Add custom logic: A simple case study (video)

   3. Step 8: Connect your own domain and publish

   4. Step 9: Enable Google authentication

3. 🔒 Going Further

   1. How to plug free session recordings and heatmaps

   2. How to connect free app status monitoring

   3. How to send more emails

   4. Intro: How to modify the product once it’s on production

Let’s dive in!

Before we proceed, I’d like to recommend the AI Product Management Certification. It’s a six-week cohort taught by instructors like Miqdad Jaffer.

I participated in the cohort in Spring 2024. The next session starts on Sep 15, 2025 (edited).

I secured $500 discount for our community if you use this link to sign up:

Get a $500 discount

1. How to Use Lovable B2C SaaS Template

Step 1: Clone my template

My template is available here: public template project.

Get Lovable B2C SaaS Template

Next, click “Remix” in the top right corner. You will have to log in or create a new Lovable account:

Step 2: Connect Supabase

After creating a copy, connect it to Supabase by clicking a green button in Lovable. You will have to create a Supabase account if you haven’t already:

Even though you can use a free Supabase version, it doesn't support backups. For production environments, I highly recommend choosing at least the Pro plan (~$25/month, including $10/month compute credits) and a Micro instance (~$10/month for the compute).

Wait for the project status to turn green before going back to Lovable:

Finally, click the Supabase icon again, select your database from the list, and click “Connect.”

Step 3: Run database migration scripts

In Lovable chat window ask Lovable to:

Since this project is based on another Lovable template, you need to execute the database migration scripts. You can find them in the supabase/migrations folder.

After a successful migration: Log in to Supabase > Your project > Authentication and create a new user with e-mail authentication for testing:

Step 4: Connect GitHub

Connect to GitHub and sync with the code repository by clicking this icon in Lovable. You will have to create a GitHub account, if you don’t have one:

You can test it, for example, by uploading primary-logo.svg that will automatically override and replace the app logo:

Step 5: Connect and configure Stripe

Create a free Stripe account.

Next, go to https://dashboard.stripe.com/apikeys and generate a new Stripe API key. Save it somewhere.

Step 5.1 Initialize products and prices

Next:

• Ensure you have npm installed locally. If you don’t know how, ask ChatGPT.

• Download the following script: stripe-setup.js (Google Drive):

  • It automatically creates products and prices and configures customer portal.

  • You can adjust it with a text editor or edit these products later in Stripe.

• Open the same folder with command line/bash and execute two commands:

npm install stripe prompt-sync

node stripe-setup.js

The second command will ask you for the Stripe API Key.

Step 5.2 Configure Stripe in GitHub

After the script configures Stripe, it will create a “stripe.ts” file in the same folder, for example:

Which in the app will be visible as:

Next, view GitHub repository, then find and edit the following files with Stripe configuration:

• src/config/stripe.ts

• supabase/functions/shared/stripe-config.ts

Replace their content with the stripe.ts generated in this point.

Important:

• Replace two files, not one. I skipped that part in the video.

• After connecting GitHub, Lovable might get confused. I often get chat history from the original project. Wait 5-10 minutes and the problem should be resolved automatically.

Step 5.3 Configure Stripe API Key in Supabase

Finally, go back to your Supabase > Edge Functions > Secrets and create a secret “STRIPE_SECRET_KEY” with the Stripe API Key we created at the beginning of this step (it’s used by edge functions):

Video With Steps 1-5

From copying a template to receiving first payments:

2. How to Create a Custom B2B SaaS Product Based on The Template

Step 6: Modify content, look, and feel

I covered best practices of working with Lovable in my two previous posts:

• Best Practices: How to Quickly Build SaaS Products With AI (No Coding)

• A Complete Course: How to Build a Full-Stack App with Lovable (No-Coding)

An extensive checklist specific to this template:

Read more

Many subscribers have been asking me about building full-stack apps without coding. And while we covered best practices, I never demonstrated the full processes.

Inspired by the recent post, Mastering AI Evals: A Complete Guide for PMs, I spent 2+ hours documenting everything.

We start from a blank page and build a web app (LLM Trace Evaluator) with:

• Data stored in a database

• Secure user authentication

• Roles and permissions enforced by the backend

No cuts. No fast forwards.

Just me, Lovable, and Supabase.

The end result:

Below you’ll find the full video (2:16:54) with chapters:

• (00:00) Our objective: Analyzing and evaluating LLM traces

• (00:57) Plan and initialize the app layout

• (04:25) Build a record viewer (the main component)

• (09:09) I'm fixing UI/UX issues

• (15:58) Connect to Supabase

• (52:41) I'm fixing quick reports

• (56:00) Add a filters component

• (1:06:26) Create a dedicated reports page

• (1:20:32) Add roles, permissions, and policies

• (1:36:00) Improve mobile views and the layout + GitHub

• (2:00:00) Summary (and small fixes)

P.S. I comment on each step and share best practices, but if anything's unclear, I’ll answer all your questions during our weekly Zoom session on Tuesday.

P.S.S. In May 2025, I’ll record another video on setting up Stripe integration and adding Google authentication, so you can monetize your product 🚀

Let’s dive in: 👇

Read more

Every week, I share actionable insights and resources for PMs. Here’s what you might have recently missed:

• The Ultimate List of 147 Product Manager Interview Questions

• The Ultimate ChatGPT Prompts Library for Product Managers

• Step-By-Step Introduction to AI Agents

• Introduction to AI Product Management

• Product Strategy Examples: Google Maps, Netflix, OpenAI

Consider subscribing and upgrading your account for the full experience:

Subscribe now

Updated: January 23, 2026

For the last 2 months, I’ve been researching dozens of AI tools to test if they can create a SaaS web app without an experienced Engineer.

I’ve been repeating that AI can't create anything more than “a snake game.” I even shared my frustration on Reddit:

The consensus was that we’re not there yet. That “you always need an experienced Engineer.”

But I kept trying and realized I was wrong. We can already use AI to create apps that actually work.

I was excited.

Below is a SaaS web app (not a prototype) for managing customer testimonials with business logic, database, roles, and permissions. Built in 1 day:

How does the solution work from the Administrator's perspective? Here’s a short walkthrough video:

It was just a research project, but it allowed me to cancel my $250/year SaaS subscription for the testimonial.to:

You can test it and recommend my courses or newsletter here: https://testimonials.productcompass.pm/ 🙏

I also validated that I could find new customers (a Beachhead Segment) and scale if that were my goal. My first customer has become . His custom domain: https://testimonials.d-pereira.com/

In this post, I explain how to create similar products targeting the must-have needs of selected customer segments.

For example:

• Credly by Pearson (certificates),

• Calendly (appointments),

• Bitly (link shortening),

• Typeform (surveys),

• Trello (tasks).

Of course, creating products is not your job as a Product Manager (though, who knows, the roles might blend in the future).

Next week, I will publish a post on AI prototyping, particularly the available tools, what AI prototyping means for cross-functional teams (the Product Trio), and how it can be used in your Continuous Product Discovery.

But in this issue, we focus on those of you who want to build simple apps, e.g., to:

• Get your first product experience.

• Test your business idea by quickly creating an minimum product people can use (not a prototype).

• Automate your work without paying for expensive tools.

We discuss:

1. Recommended AI Tools for Creating Minimum Viable SaaS Products

2. 🔒 The AI No-Code Blueprint: Nine Best Practices and Mistakes to Avoid

3. 🔒 Update: Vibe Engineering Best Practices (January 2026)

4. 🔒 Lovable AI Solutions Architecture Overview (with detailed Supabase, Netlify, and GitHub configuration)

5. 🔒 Video: Collaborating With Lovable to Make Changes in My Product

6. 🔒 Survey About Recording a Step-By-Step Case Study / Live Workshop

P.S. This post was not sponsored.

AI Product Management Bootcamp With Dr. Nancy Li

Before we go further, my friend, Dr. Nancy Li, is running the most hands-on AI Product Management Bootcamp that matches Product Managers with a team of AI Engineers, Data Scientists, and UI/UX Designers to create and launch real-world AI products.

You can learn more by attending her free AI PM workshop next week. Dr. Nancy Li will discuss the 5 key traits that separate AI PM from the pack in 2025 and her secret AI PM lifecycle framework that enabled product managers to launch 21 real-world AI products in 3 months.

You can register for the free AI PM workshop here:

Register for the free AI PM workshop

1. Recommended AI Tools for Creating Minimum Viable SaaS Products

I’ve researched dozens of tools from three categories. Including, but not limited to:

No-code tools

• Bubble: A popular solution with a drag-and-drop experience and built-in building blocks (list, grid, table, logins, payments, integrations). It’s complex. I quickly concluded that its learning curve was too high for me.

• Softr: Similar to Bubble, but a bit more straightforward to use. It supports multiple data sources (Notion, Airtable, Google Sheets, SQL). I felt that the ability to customize UI was too limited. More importantly, their pricing model (per app user) disqualified it:

  

• Retool, Airtable: Platforms for building internal tools, databases, admin panels, and dashboards. Great for internal use but not viable for SaaS applications.

Conclusion: Bubble is the best low-code/no-code tool you can use to build a commercial SaaS application. But it might not be worth the effort.

Local AI coding assistants

• Windsurf: I installed it as a Visual Studio Code extension. After struggling with installation (Node.js, Python) and learning basic PowerShell commands (thanks ChatGPT!), I was able to use their chat window (Cascade) to work with Claude 3.5 Sonnet. I quickly realized that the number of errors, missing dependencies, and the required technical knowledge were overwhelming.

  

• Cursor: I installed it as a Visual Studio Code extension. The experience was very similar to Windsurf. Even after starting with “ready-to-use” SaaS templates like Bolt Boilerplate, Cursor struggled with the Convex database, Clerk authentication, and making changes in my application.

  

• V0: Based on my research, it resembles Windsurf and Cursor. I didn’t test it, so I don’t want to provide inaccurate information.

Conclusion: Windsurf, Cursor, and V0 might support Engineers to become even more effective. But if you want to create products just by prompting with minimal technical knowledge, it’s easier to rely on simplified, preconfigured web interfaces.

“Prototyping” web-based AI tools

Tools you can use via the browser:

• Databutton: I initially liked that it doesn’t present the source code by default. I also quickly integrated with Firebase and added Google authentication for the administrator. And while it’s a good tool for prototyping, it wasn’t reliable when working with the database and business logic. I can’t recommend it for creating SaaS products that actually work.

  

• Bolt.new: In my opinion, the second-best tool for prototyping. However, just like Databutton, it struggled with the database (Supabase), business logic, and maintenance. My app kept crashing, and it required significant effort to recover.

  

• Lovable: The last “prototyping” product I tested. Initially, I was not impressed. It seemed similar to Bolt.new. But the longer I worked with it, the more I understood how to build a reliable, easy-to-maintain solution. That was precisely what I was looking for.

  

  

Conclusion: If you want to build simple SaaS products without coding, use Lovable and avoid wasting dozens of hours. When prompted in a specific way it rarely crushes. And even if that happens, you can quickly recover.

Share

2. The AI No-Code Blueprint: Nine Best Practices and Mistakes to Avoid

How to prompt and work with AI to create similar apps reliably and without coding?

Here, I’ll focus on Lovable, but many of those practices are universal.

First, while Lovable offers a free version, realistically, you need at least a $20 or $50 subscription. The $20 subscription was enough for me to build a single app.

By default, it uses:

• GitHub for code repository. You need to create a free account, Lovable will take care of the rest.

• Supabase as a database. It also offers server-side functions, authentication (login and password, social providers, etc.), and permissions. You need to create a free account and provide a public key. Lovable will take care of the rest.

• Netlify for website hosting. You must create a free account and connect it to your GitHub repository. Optionally, you can also configure a custom domain in Netlify.

I will discuss the architecture in more detail in the next chapter. Here, let’s focus on the best practices.

[Update: January 23, 2026] The tools have evolved. See “3. Update: Vibe Engineering Best Practices (January 2026)” in the next part of the post.

Best practice 1: Precisely define small tasks

As Product Managers, we are used to communicating the strategic context and goals with clear desired outcomes. Or high-level user stories. I tried the same with AI multiple times.

But it didn’t work.

Instead, you must plan and precisely define small tasks with clearly defined outputs.

One at a time.

Best practice 2: Refer to specific UI elements

Our language (e.g., “the blue button at the top”) might not be precise enough. Lovable allows you to select a specific element.

If you use that option, it will perfectly understand the context (component or even a specific part of code) you are asking about.

Best practice 3: Understand the building blocks

Read more