Glossary
Short answers to the specific questions that come up when a prototype has to become a product.
The Plutonapps glossary is 48 plain-English definitions of the terms that decide whether an AI-built app is ready for real users. Each entry opens with an answer you can quote, then says what the term changes once an app built in Lovable has real users, with sources where there is a fact to check. Updated .
Terms starting with A
AI app builder
An AI app builder is a tool that turns a plain-language description into a working web application, generating the screens, the data model and the logic, and often hosting the result.
Audit log
An audit log is a permanent, append-only record of the significant actions taken in a system, showing who did what, to which record, when and from where, kept as evidence.
Authentication vs authorization
Authentication is proving who someone is, by password, one-time code or Google sign-in, while authorization is deciding what that signed-in person is allowed to do, such as which records they may read or change. Authentication happens once per session; authorization is checked on every request.
Terms starting with B
Terms starting with C
CI/CD
CI/CD, short for continuous integration and continuous delivery or deployment, is the automated pipeline that builds and tests every change to an app, then releases each change that passes, either at the push of a button or automatically.
Code audit
A code audit is a structured review of a whole codebase by experienced engineers, looking for security holes, reliability risks and code that will be hard to change.
Code handover
A code handover is the transfer of software from one team to another, including the code and its history, the accounts it runs on, the secrets, the documentation and the knowledge of how it is released.
Terms starting with D
Data processing agreement (DPA)
A data processing agreement (DPA) is the contract required by Article 28 of the GDPR between a controller, the business that decides why personal data is used, and a processor that handles that data on its behalf.
Database index
A database index is a separate lookup structure, kept by the database, that lets it find the rows matching a condition without reading the whole table, much like the index at the back of a book.
Development subscription
A development subscription is a way of buying software engineering as a flat monthly plan for reserved engineering capacity, instead of paying by the hour or agreeing a fixed price for each project.
Terms starting with F
Feature flag
A feature flag is a switch in an application's configuration that turns a feature on or off, for everyone or for chosen users, without deploying new code.
Fractional CTO
A fractional CTO is an experienced technology leader who works for a company part time to set technical direction: architecture and stack, reviews of what has been built, engineering hiring and advice to founders and investors.
Terms starting with I
Idempotency
Idempotency is the property of an operation that has the same effect whether it runs once or many times, so a retry, a double click or a redelivered webhook cannot charge a card or send an email twice.
Incident response
Incident response is the plan a team follows when something goes wrong in production, such as an outage, a data leak or a bad release, decided in advance rather than improvised.
Terms starting with L
Load testing
Load testing is running an application under a realistic, simulated volume of users or requests to measure how it performs: response times, error rates and where it slows down.
Lovable Cloud
Lovable Cloud is the backend built into Lovable: the database, user sign-in, file storage and server-side functions your app needs, created and managed from inside the Lovable editor.
Terms starting with M
Minimum viable product (MVP)
A minimum viable product (MVP) is the smallest complete version of a product that real users can get real value from without the founder beside them: one kind of user, one journey, finished properly.
Model Context Protocol (MCP)
The Model Context Protocol (MCP) is an open standard that lets AI assistants such as Claude, ChatGPT or Cursor discover and call an application's tools and read its data on a user's behalf, through an MCP server.
Multi-factor authentication (MFA)
Multi-factor authentication (MFA) is a sign-in method that requires two or more different kinds of proof: something you know, such as a password, something you have, such as a phone, or something you are.
Multi-tenancy
Multi-tenancy is a software design in which one running application and its database serve many customers, called tenants, while each tenant sees only its own data.
Terms starting with O
OAuth
OAuth 2.0 is an open standard that lets an app get limited access to a user's account on another service, such as their Gmail or calendar, without ever seeing their password.
Observability
Observability is the ability to understand what a running system is doing, and why, from the data it emits: logs of events, metrics such as error rates, and traces that follow one request through every service.
Terms starting with P
Penetration test
A penetration test is an authorized, simulated attack on an application or system in which security testers try to exploit weaknesses the way a real attacker would, then report what they reached.
Point-in-time recovery (PITR)
Point-in-time recovery (PITR) is a way of restoring a database to its exact state at any chosen moment, such as one minute before a bad deploy, rather than only to the last scheduled backup.
Product engineering
Product engineering is the work of turning a software product idea into a system people can rely on, then keeping it reliable: architecture, data, security, testing, releases and running the live service.
Production-ready
Production-ready describes software that is safe to put in front of real users because access is enforced, changes are tested, releases can be rolled back, failures raise alerts and data can be restored.
Terms starting with R
Rate limiting
Rate limiting is a control that caps how many requests a user, API key or IP address can make in a set period, such as 100 per minute, and refuses the rest; slowing them instead is called throttling.
Refactoring
Refactoring is restructuring the internal design of existing code without changing what it does for the user, done in small steps that each keep the software working and easier to change.
Regression testing
Regression testing is re-running a suite of existing automated tests after every change to an app, to confirm that features which already worked still work and that a fix in one place has not broken another.
Role-based access control (RBAC)
Role-based access control (RBAC) is a way of managing permissions in which rights are granted to roles, such as owner, admin, editor or viewer, and people are given roles.
Row-level security (RLS)
Row-level security (RLS) is a database feature that decides, row by row, which users may read or change data, through policies the database enforces on every query.
Terms starting with S
Schema migration
A schema migration is a versioned script that changes the structure of a database, such as adding a table, a column or an index, kept in the code repository and applied in order to every environment.
Secrets management
Secrets management is the practice of keeping an application's credentials, such as API keys, database passwords and OAuth tokens, out of code and out of the browser.
Single sign-on (SSO)
Single sign-on (SSO) lets people sign in to many applications with one login, usually their company account at an identity provider such as Okta, Microsoft Entra ID or Google Workspace.
SLA vs SLO vs SLI
SLA vs SLO vs SLI is the chain from measurement to promise: an SLI measures how a service performs, an SLO sets the target for that measure, and an SLA promises customers that level in a contract, with consequences. For example, 99.9% of requests succeeding over 30 days.
SOC 2
SOC 2 is a report in which an independent CPA firm examines whether a company's controls protect customer data, measured against the AICPA's criteria for security, availability, processing integrity, confidentiality and privacy.
Staff augmentation
Staff augmentation is hiring engineers from an outside company to work inside your own team, under your management and day-to-day direction, for as long as you need the extra capacity.
Staging environment
A staging environment is a private copy of your production system, with the same code, configuration and kind of data, where each release is deployed and checked before real users see it.
Supabase
Supabase is an open-source backend platform built on PostgreSQL that gives an app a Postgres database with an instant API, user sign-in, file storage, realtime updates and server-side functions in one project.
Supabase anon key vs service role key
The Supabase anon key (now called the publishable key) identifies your app and is safe to ship in the browser, because row-level security decides what it can reach. The service role key (now the secret key) bypasses row-level security entirely, so it belongs only on a server and must never appear in client code.
Terms starting with T
Technical co-founder
A technical co-founder is a founder who takes responsibility for building the product: its architecture, its code and, later, its engineering team, usually in exchange for a significant share of the company rather than a salary.
Technical debt
Technical debt is the extra cost you pay later for shortcuts taken in software now: code that works but is hard to change, missing tests, duplicated logic, decisions nobody wrote down.
The real product
The real product is the live, engineered version of the app you design in Lovable: the software your customers actually use, which Plutonapps engineers build, test, release and support while you keep designing.
Terms starting with V
Vendor lock-in
Vendor lock-in is the situation where leaving a software supplier, platform or agency would cost so much time, money or risk that you effectively cannot.
Vibe code cleanup
Vibe code cleanup is the engineering work that makes an AI-generated app safe and maintainable: closing security gaps, putting access rules in the database, adding tests and removing duplicated code.
Vibe coding
Vibe coding is building software by describing what you want to an AI in plain language and accepting the code it writes, judging the result by whether it works rather than by reading the code.