Platform lock-in: platform.hardcoded_url
This is the part of the audit about leaving rather than security: the places where your app depends on the builder's own services and URLs. Each one keeps working only while the app runs on the platform. offramp reports one finding per kind of coupling and cites up to five places where it appears.
Tests, documentation and lockfiles are skipped, because a URL in a README or a test does not break the running app.
Emergent
| Finding | Severity | Fix |
|---|---|---|
The app calls its own Emergent preview deployment (*.preview.emergentagent.com), often as the backend URL the frontend is built with. It stops answering when the preview is shut down. | medium | Read the URL from the environment, and set it to the new deployment's address. |
| Sign-in runs through Emergent's managed login. Users cannot sign in once the app no longer runs on Emergent. | medium | Replace it with an auth provider you control before moving, and plan how existing users will sign in afterwards. |
| Calls go through Emergent's integrations proxy with a platform key, rather than to the provider directly. | medium | Call the provider directly with your own account and key, from server-side code. |
| The platform's editor scripts load in production, from Emergent's CDN. | low | Remove the script tags and the dependency once you no longer edit in the platform. |
| Images are served from Emergent's storage, which you do not control. | low | Copy the files into your own storage or the repository, and update the links. |
Lovable
| Finding | Severity | Fix |
|---|---|---|
| AI calls go through Lovable's AI gateway with a Lovable key. They stop working outside Lovable, and usage is billed through the platform. | medium | Call the model provider directly with your own key, from a server-side function. |
| Integrations go through Lovable's connector gateway rather than the provider's own API. | medium | Call each provider's API directly with your own credentials. |
A Lovable deployment URL (*.lovable.app) is written into redirects, links or allowed origins. | medium | Read the site URL from the environment, and set it to your own domain. |
Lovable's editor script (gptengineer.js) loads in production, so every visitor downloads a script the app does not need. | low | Remove the script tag from index.html once you no longer edit in Lovable. |
| Link previews use Lovable's default social image. | low | Replace the og:image and twitter:image tags with your own image. |
Fixing these does not require leaving the platform. It means that when you do leave, nothing breaks on the day.