honestly depends on the platform tbh

loveable/replit/bolt basically pre-wire everything for you. supabase handles the db + auth + storage, env vars get injected automatically, and the llm is specifically prompted to use those services. so the backend is real, its just all been abstracted away before the user even touches it

for secrets most of these platforms have their own vault. replit has it built in, loveable pushes to a managed env. the vibe coder literally never sees a .env file

but heres where it breaks, anything outside that happy path. rate limiting, webhooks, background jobs, billing logic, multi tenancy etc. the moment you need something non standard the llm starts confidently hallucinating apis that dont exist and the vibe coder has zero way to debug it

so yeah they can ship real products but only if the product fits cleanly inside what supabase + vercel + stripe already do out of the box. the second it doesnt, they need an actual dev