Describe a business. Get a working app in seconds, with its own management area. Then keep it verified, with signed proof, for as long as it runs.
Drop in traffic to vibe-coding tools in spring 2026. Owners tried AI-built apps and left.
Annual retention of AI apps versus 30.7% for the rest. The apps did not keep working.
Of vibe-coded apps ship at least one flaw invented by the model. Nobody signs off on what was built.
Hebrew is native, right to left, on the same engine. Deep multi-screen generation is the next build mode.
Apps built through the production pipeline, 933 of them in the last 30 days. Closed access, 0 external users, by choice.
count · D1 app_metadata · 2026-09-07
Measured cost of goods per build across 2,589 builds. At $19 per month that is a ~91% gross margin; the exit template below is being rebuilt by its acquirer to reach 60%.
Tampering attempts rejected by the Proof Passport signature scheme. Deterministic judge accuracy 0.954 against 0.800 for a frontier model and 0.477 for a cheap one.
× $29 average per month = $3.5M ARR. Israel first: founder-led distribution in Hebrew, WhatsApp and Facebook business groups, and a documented wedge of owners angry at 20% marketplace commissions.
× 20 inherited apps a month × $199 = $2.4M ARR, replacing $500 to $8,000 of human clean-up each. Buyers: agencies, fractional CTOs, and teams inheriting Lovable, Bolt and v0 apps.
× $25K per month = $0.6M ARR, and every one of their generated apps becomes a passport holder. Platforms are being pushed to prove safety; none can do it independently.
The recurring engine, not one-off audits, is what earns the multiple. $8–12M ARR at 8–12× revenue, or ~$5M ARR at ~20× to a strategic buyer, is the range the recent comparables paid. Base44 sold to Wix for $80M cash at $3.5M ARR, with earn-outs of roughly $128M more; under Wix it reached $150M ARR in 11 months.
| Capability | Lovable · Bolt · Base44 | QA Wolf · Momentic · Meticulous | CodeRabbit · Qodo | Lovable TrustCenter · Replit Security Agent | Pomela |
|---|---|---|---|---|---|
| Working app for a non-technical owner, with a management area | partial | — | — | — | ✓ |
| Runs the finished app like a real user, every control | — | tests you write | — | static scan | ✓ |
| Checks permissions and persistence across owner, customer and staff | — | — | — | partial | ✓ |
| Maps claims to evidence, lists what was never tested | — | — | PR-shaped | — | ✓ |
| Signed, scoped, expiring attestation (open format) | — | — | — | — | ✓ |
| Draft → verified → atomic publish; safe autofix | draft only | — | PR fixes | — | ✓ |
| Independent of the platform that built the app | — | ✓ | ✓ | self-scan | methodology + open format |
Generating more code faster is their business; proving it is a conflict of interest. Their margins cannot carry a verification fleet either: the category leader's acquirer is building its own model to reach 60% margin. Pomela builds at $0.033.
Exploratory QA agents and "govern AI code" review tools are PR-shaped; none exercise the finished app, hold state across roles, or sign what they found. That window is the reason to move now.
Naval systems, robots and trading engines do not get a second chance. Neither should the app a business runs on.
Two engineers on the verification fleet and detectors, one product designer, one Israel go-to-market lead. Named advisors from the verification and security community join a small bench.
Run the full suite on the 37-category corpus plus 50 external Lovable, Bolt and v0 apps against a frozen answer key. Publish precision and recall per failure type. Hard gate.
10–20 agencies and inheriting teams, some paying, at least three repeating. Real apps, authorised scope only.
Open skill, public benchmark with raw runs, a known-bad demo app, a sample passport and a limitations page.
Paid verification with fixes delivered in a branch, never in production. Create grows quietly as the Israeli beachhead.
Every app an AI builds will carry a signed passport of what it can do, what failed, and what was never tested. Pomela issues it.
Milestones for the next round: detectors generalise on external apps with published accuracy, a recurring continuous-passport revenue line, and two platform licences. Three exit lanes stay open by design: platforms, security, and AI labs.