isitvibecoded

Blog Platform fingerprints

Every AI builder leaves a fingerprint. Here's where each one hides.

Lovable, v0, Bolt, Replit and Base44 all sign their work, none of them on purpose. What each one leaves in the markup, which artefacts survive a migration, and why an asset host is not a confession.

By

Nobody ships a page meaning to announce which tool built it. It happens anyway, because a builder has to put its runtime somewhere, serve its images from somewhere, and name its data attributes something. Those decisions outlive the export, the custom domain, and usually the person who did the exporting.

The stack detectors on this site look for exactly that residue. They are the heaviest category in the whole set, and they're also the one where being wrong is most embarrassing, so they're the ones with the strictest rules about what counts.

The distinction that does all the work

There are two very different things a page can contain: an artefact the builder wrote, and an association with the builder's brand. Only the first one means anything.

Lovable is the clearest example, because its detector splits down the middle. Find lovableproject.com, a data-lovable attribute, lovable-tagger, or a /__l5e/ path, and the page carries a build artefact: nobody types those by hand, and the detector sets a score floor of 82 that the rest of the page is not allowed to argue below. Find a bare lovable.dev asset host and you get the same 24-point weight but no floor at all, because loading an image from lovable.dev is also exactly what linking to the product looks like. lovable.dev's own marketing site is in our worked examples and scores 21 out of 100, which is the correct answer for a company that writes about its own product.

A page that writes about v0 is not built by v0, and a customer logo named lovable.svg is not a fingerprint.

That's why every stack detector reads from what the code calls the machine surface: asset hosts, meta tags, HTML comments, data attributes. The visible copy is off limits. It has to be, or the scanner convicts every blog post ever written about these tools, including this one.

What each builder actually leaves behind

The tells that aren't about any one builder

Some of the heaviest stack signals name no vendor at all. An untouched scaffold title is worth 26 points, because a page still called "Vite + React + TS" in production tells you nothing was reviewed. The Tailwind Play CDN in production is 24 points: the browser compiling Tailwind at runtime is a development convenience that nobody ships on purpose twice. Still being served from a platform subdomain like *.vercel.app or *.lovable.app is 14 points, meaning no custom domain was ever attached.

Then there are the house tools. shadcn/ui class signatures and the Lucide icon set are 12 points each, and both are perfectly good choices that thousands of hand-built sites use deliberately. They're light for that reason. They tell you which shelf the parts came off, not who assembled them.

The builders can't pass their own test

The most useful thing about running this over the tools themselves is how differently they score. base44.com lands at 82 out of 100, the highest in our entire worked-example set. v0.app comes in at 37. bolt.new sits at 15, replit.com at 9, and lovable.dev at 21. Five companies in the same business, and the spread between them is wider than the spread between Craigslist and Stripe.

That's not a moral ranking. It mostly measures how much of their own product each company pointed at their own marketing page, which is a choice with real tradeoffs and not obviously the wrong one.

If you're cleaning up after a migration

Where it shows up

Related signals

Checking whether your own page does this takes one paste, not a manual audit.
Scan a page for this signal →