Blog

Testing vibe-coded prototypes: Figma Make, Lovable & v0

July 21, 2026 · 6 min read

Something changed in the last year: making a working prototype stopped being the expensive part. Tools like Figma Make, Lovable, and v0 turn a prompt into a clickable, deployed app in an afternoon — real navigation, real state, real forms. Yet a lot of testing still happens on static mockups or click-through hotspots, because that's what testing tools were built for. If the prototype is already a live app, why not test the live app?

The gap between “built” and “tested”

A static prototype can only be tested where you drew hotspots. Real behaviour — a mistyped field, a dead end, a back-button loop, the third thing they tried before the second — happens between the hotspots, exactly where a mockup has nothing to record. A live prototype has all of that behaviour already. The only missing piece is a way to observe it without rebuilding the app inside a testing tool.

A snippet, not a rebuild

The approach is deliberately low-tech: a one-line script — the Lens beacon — dropped into your prototype. Every AI builder can add it: paste it into the HTML, or literally ask the builder “add this script to every page.” From then on the app reports two things back to your test:

• Clicks — what was tapped, and where, as coordinates that line up with a screenshot so they can be painted as a heatmap.
• Screen views — the route the participant moved through, so you can reconstruct their journey.

That's all it captures — no form values, no keystrokes, no page content. The participant opens your real prototype in a new tab, does the task, and the interaction data streams back to the results page next to their self-reported outcome and answers.

Success without watching every session

You can tell a task “done” by naming the URL that means success — reach the confirmation page and the task auto-completes, no self-report needed. Combined with the click heatmap and the screen-path view, you get the two things unmoderated testing usually makes you choose between: whether people succeeded, and wherethe ones who didn't fell off.

The honest caveats

It isn't magic, and pretending otherwise wastes your time. A few things to know going in:

• The app has to run the snippet. Some hosts strip injected scripts on publish, or sandbox iframes — check the beacon actually fires before you send the link out.
• Cross-origin means you see clicks and routes, not the DOM. It's behavioural telemetry, not full session replay.
• Re-publishing the prototype can drop the snippet. Re-verify after any redeploy.

None of that changes the core win: the prototype your team already vibe-coded this week is testable this week — with real people, on real behaviour, without building it twice.

← All posts