Your prototype is a spec, not a product.
Lovable and Claude let anyone put a working app on screen in a weekend. That is the best thing to happen to product ideas in years. It also moved the hard part, and that is where we built the SaaS Factory.
The demo got cheap. The rest did not.
A year ago, a dental-practice owner, an installer or an insurance broker with an idea for software needed a developer before they could show anyone anything. Today they open Lovable on Friday evening and have a convincing app by Sunday. Their colleagues click through it and say: I would pay for that.
That is a genuine shift, and we are not here to talk anyone out of it. More ideas reach a working screen than ever before, built by the people who understand the problem best. The question that used to be “can we build it?” has been answered for almost everyone.
The new question arrives a few weeks later, usually as an attachment. A customer’s security questionnaire. A tender that asks for your ISO process. An investor who wants to know who is accountable when it breaks. And the prototype, however good it looks, has no answer.
- The flow makes sense
- The words land with users
- Someone would pay for it
- Customer two cannot see customer one’s data
- Payments, an audit trail, privacy features
- Backups that have actually been restored
- Updates that do not break what worked
- A signed answer to the questionnaire
Why “just keep prompting” stops working
The tools are not the problem. The setup is. In a prompt-to-app tool, every change is generated for the moment. Nothing accumulates. Login, permissions and data separation are reinvented per app (sometimes per prompt) with fresh bugs each time. And the same model that writes the code decides whether the code is done.
That shows up in the numbers. In Veracode’s 2026 study, 44% of security tests on AI-generated code failed when the model was not given security guidance. The models are getting smarter. That figure has not moved much. The leaks that made the news this year (AI-built apps exposing their users’ data) were rarely clever attacks. They were open doors nobody had checked.
of security tests on AI-generated code without security guidance.
Veracode · GenAI Code Security Report · 2026Same agents. Different physics. The difference is not the model, it is what the model works inside.
Three layers a prompt cannot give you
We write most of our code with coding agents too. They are our engine, not our rival. What we sell is everything around them.
So use both
Prototype with Lovable or Claude for as long as you are finding out what to build. It is fast, it is cheap, and it puts the decisions with the person who knows the customer. Then bring the prototype to us. We keep what it taught you (the screens, the flows, the words your users understood) and rebuild the product on Entry and our blocks, behind the gates. Your prototype becomes the clearest specification we have ever been handed.
One week to scope it. Six weeks to a secure MVP in European production. Three months to an operational SaaS product with customers, billing and monitoring. And then someone who answers the phone.
Why this matters more in the Netherlands now
Since 15 August 2026 the Cyberbeveiligingswet (the Dutch NIS2 law) is in force. Organisations that fall under it have to check their software suppliers. They pass that obligation down the chain, which means the questionnaire now lands on small product companies that never expected one.
For a domain expert with a good product, that is not a reason to stop. It is a reason to build on something that already has the answers: an ISO 27001-certified process, hosting in Europe, source code in escrow, and a signed security report per release.
The first product through the factory is our own. We publish the timed log, week by week.
The same way we put AI into Yessa, our own veterinary product, before we built it for anyone else.
Prototype it anywhere. Build it here.
Four ways in, each with a proposal made for your product. Start with a Factory Sprint, or have your AI-built app audited first.
Published October 2026 · 7 min read