Vibe Coding SEO: The Same App, 46/100, and Invisible to Half of Search

Quick answer: vibe-coded apps tend to look done long before they're findable. Tools like Lovable, Bolt.new, v0, and Cursor generate a working page fast, but "working page" and "a page Google, and increasingly ChatGPT or Perplexity, can actually find and understand" are two different bars. In the same real app we scanned for our last post, the one that scored 100 on performance with six high-severity security gaps hiding underneath, the SEO pillar came back at 46 out of 100.

If you read the security post, you already know the setup: real app, built fast with an AI coding tool, shipped without a second thought, run through a free FlawPilot scan that checks security, performance, infrastructure, and SEO in about two minutes. We covered the under-the-hood security findings last time. This is the other half of that same report: what the SEO pillar found, and why a site can look completely normal in a browser while being close to invisible to everything that isn't a person clicking through it by hand.

The scorecard, again

67 out of 100 overall. Four pillars, and SEO was the weakest of them:

• Security: 70/100. Needs attention. 16 findings.
• Performance: 100/100. Excellent. Zero findings.
• Infrastructure: 54/100. At risk. 10 findings.
• SEO & Discoverability: 46/100. At risk. 9 findings.

That gap between a perfect performance score and a 46 on SEO is the whole story in one line. The app is fast. It renders cleanly. None of that is what search engines, or AI answer engines, actually use to decide whether to show it to anyone.

What was missing, and why it doesn't show up when you click around

Open the site in a browser and everything looks normal: a title, a hero section, a working nav. None of what's actually missing shows up unless you look at the page the way a crawler does, not the way a visitor does.

There was no robots.txt file at all. That's a direct, named finding straight from this app's report, rated the top SEO issue on the list. Crawlers hit the site with no instructions and are left to guess what to index and what to skip. It's the SEO equivalent of not having a front door sign: not necessarily catastrophic, but a strange thing for a real business to be missing.

The other eight findings on this report's SEO pillar weren't ones we're naming individually here, but the shape of them is familiar to anyone who's looked at more than a few AI-scaffolded sites: a missing sitemap.xml, so nothing tells a crawler what pages exist or how they relate to each other; thin, duplicated, or entirely absent structured data, meaning nothing on the page is machine-readable as "this is a company" or "this is a product" rather than just floating text; and generic or repeated meta descriptions that make search results show the same unhelpful line on every page. These are the gaps that show up most often when we scan sites built this way, whether or not every one of them was on this specific list.

None of that breaks the app for a person using it. All of it makes the app harder for anything automated to understand, and "anything automated" is now doing more of the deciding about who ever sees your site than it used to.

The part that's new in 2026: AI search can't find it either

Here's the piece that wasn't really a category two years ago. It's not just Googlebot deciding whether to show this app in search results anymore. It's ChatGPT, Perplexity, Claude, and Gemini deciding whether to mention it at all when someone asks a question it could plausibly answer.

The same gaps that hurt traditional SEO hurt this even more directly. A missing robots.txt means no rules for AI crawlers like GPTBot, ClaudeBot, or PerplexityBot either, a direct extension of the finding already on this app's report. Sites in this shape also typically have no llms.txt file, the emerging convention some AI systems check for a clean, structured summary of what a site actually is, and little to no structured data for an AI system to work from. Put that combination together and an AI answer engine trying to describe a product like this one has almost nothing reliable to go on. Not blocked, exactly. Just never handed anything worth citing.

That's a real, separate axis from classic SEO now, sometimes called AEO (answer engine optimization) or GEO (generative engine optimization), and it's scored as part of the same SEO pillar in a FlawPilot report rather than treated as a separate category, because functionally it's the same problem: can something that isn't a human reading the page understand what it's looking at.

Why this is the default, not a fluke

None of this is a knock on Lovable, Bolt.new, v0, or Cursor specifically. They're optimized for "does the page render correctly and match the prompt," and a page renders identically whether or not it has a sitemap, a robots.txt file, or a single line of structured data. SEO has no visual signal. Nothing looks broken. That's exactly why it's the pillar that scores lowest across most AI-generated apps we've seen: performance and functionality get checked constantly, by every click during development. SEO gets checked by nobody, because there's no obvious moment where it fails in front of you.

The cost also shows up on a different clock than a security gap does. A missing security header can get found and exploited within days. A missing sitemap or a blank meta description just means slowly, quietly, showing up less often in search results and AI answers, for months, with no error message telling you why. By the time a founder notices organic traffic isn't growing, the gap has usually been there since launch.

Found it. Now what?

Same approach as the security side of this report: findings get grouped by area and dropped into a ranked "What to do next" list, not a raw dump of technical terms. Item one on the SEO pillar was the missing robots.txt, and next to it, in plain English: add a robots.txt file so crawlers know what to index, and add rules for AI crawlers so answer engines can find you too.

Most of what's on this list is genuinely fast to fix. A robots.txt file and a sitemap.xml are static files, not a rebuild. Structured data is a script tag, not a redesign. An llms.txt file is a few sentences of plain text. None of it touches the app's actual functionality, which is exactly why it's worth doing before it's worth agonizing over: this is an afternoon of markup, not a sprint.

How FlawPilot helps

FlawPilot is useful because it connects detection to remediation. A scan can tell you a site has no structured data or no sitemap. The next step, actually adding it, is what determines whether the score, and the visibility, actually changes.

Every finding lands in a ranked "What to do next" list, written in plain English instead of jargon. The fix for the top issue in every pillar, security, performance, infrastructure, SEO, is included in the free report, spelled out clearly enough to act on without an SEO background. For a full crawl of the site, and for AEO/GEO work that goes deeper than adding a few files, Logicwind's engineering team builds a prioritized remediation roadmap and puts people on it directly.

The boundaries matter as much as the capability. FlawPilot only checks publicly accessible signals to run the scan, it never touches your server, your codebase, or your credentials, and it doesn't auto-apply any fix without a human in the loop.

Your turn

You don't need an SEO background to read a report like this one. You need to run the scan.

No setup, no coding, no passwords required. Drop in a URL, and in about two minutes you get the same kind of scorecard back: security, performance, infrastructure, and SEO, each out of 100, every finding in plain English, with a toggle between the founder view and the full technical one.

Your app might already be fast and functional. Whether it's actually findable, by Google or by the AI tools increasingly standing in for search, is a different question, and it's one this scan actually answers.

Scan your site for free →

This is the second post looking at the same real scan from two angles: the first covered the security findings, this one covers SEO. Same app, same report, different pillar each time, because "it works" turns out to be a much lower bar than most people assume.