Bolt, Cursor, Lovable, Windsurf: Four Vibes, One Acceptance Test

By Muhammad Kashif · Draft · AI automation & cybersecurity builder, Pakistan

Bolt, Cursor, Lovable, and Windsurf all promise a short path from idea to running software. I treat them as four vibes under one acceptance test: same brief, same golden checks, same security minimums. Whichever vibe wins the week still has to pass the test. If it cannot, it stays a sketch — no matter how pretty the deploy URL looks in a founder Slack channel.

Four vibes, mapped

Bolt for prompt-to-cloud spikes with hosting and batteries included. Cursor for repo-native pros who live in diffs and CI. Lovable for non-dev builders who need a guided path to a credible UI. Windsurf for teams already in that editor ecosystem wanting agentic assist. Mapping beats arguing about which is "best."

Best is a function of who is typing and what "done" means. Without that, Twitter heat picks your architecture.

One acceptance test to rule the bakeoff

Auth works. Basic RBAC. Tests or at least scripted checks. No secrets in the client bundle. Accessibility smoke. Deploy rollback known. I run the same checklist on all four. Bakeoffs without identical tests are fashion shows.

Fashion shows are allowed on Friday afternoons. Procurement happens on Monday with the checklist.

When Bolt wins

Time-boxed prototypes, partner workshops, marketing sites with clear scope. Agents that test and fix help when checks exist. Payments and production auth still get a human threat pass. Bolt Cloud convenience does not retire threat modelling.

Graduation out of Bolt needs an export story. No export story means no long-term client dependency.

When Cursor wins

Existing monorepos, serious tests, security-sensitive code. Repo rules and inline review beat a fresh generated stack that nobody understands. Cursor is my default when the cost of rewrite exceeds the cost of teaching the agent the old shapes.

Long agents still get branches and time boxes. Main is not a scratchpad.

When Lovable wins

Founders who are not engineers but need a credible MVP UI for conversations with users. I pair Lovable with a hard stop: no customer PII, no real payments until a developer owns the repo. Mobile queues that notify when builds finish are fine; unsupervised production pushes are not.

Lovable energy plus a senior review hour beats shame about not coding every pixel.

When Windsurf wins

Teams standardised on it with shared rules. I do not force Cursor ideology onto a Windsurf shop if evals are green. I do force the same acceptance test and the same secret policy.

Ideology is not a control. Tests are.

Client-facing rule

We may demo on any vibe. We only standardise on a vibe that passes the checklist twice in a row with different humans driving. Continuity matters more than a single lucky generation.

Sticky note

Four vibes. One test. Sketch freely. Standardise cautiously. Pretty URLs are not production. Production is what survives the checklist and a bad Monday.

Double-drive standardisation

Two different humans must pass the acceptance checklist on the chosen vibe — Bolt, Cursor, Lovable, or Windsurf — before we standardise. One lucky driver is anecdote. Two is a beginning. Pretty URLs still wait for the checklist.

Export-or-no-retainer

If Bolt or Lovable cannot export in a form we can rebuild, I will not put a retainer on that stack. Cursor and Windsurf usually can. Acceptance tests include the exile path, not only the happy URL.

Fashion show Friday

Bakeoffs without checklists are explicitly labelled fashion shows and scheduled Friday afternoon. Monday procurement only accepts checklist packets. Bolt, Cursor, Lovable, Windsurf can all dance on Friday. Only the tested vibe works Monday.

Security minimum identical

Auth, RBAC smoke, no secrets in the bundle, rollback known — identical across Bolt, Cursor, Lovable, Windsurf bakeoffs. Skipping security on Lovable because the audience is non-technical is how demos become liabilities.

Who is typing

Bakeoff notes include who drove — engineer, founder, designer. Lovable winning with a founder driving does not mean Cursor loses for the engineering team. Four vibes; one acceptance test; context still matters when we standardise.

Checklist packet or no standard

No vibe becomes the team default without a filled checklist packet attached to the decision note. Fashion shows stay fashion. Standards stay earned.