Blog · September 10, 2026 · Rich Chetwynd
Where to host a vibe-coded app so it stays private
Where do people host the little apps they vibe code? Most pick a public URL or a VPS. Croft is the private option: company login and access per app.
Quick answer
If the app is for your team, not the public internet, do not put it on a public deploy host and hope a password field is enough. You want a private server, company login in front of every app, and access you grant by person. That is what Croft is for.
What people mean by “host a vibe-coded app”
Vibe coding is building software by chatting with an AI assistant. Cursor, Claude, ChatGPT, and Grok can all produce a working app in an afternoon. The hard part is the next step: where does it live?
Most guides answer that with a public platform or a DIY VPS:
- Public hosts (Vercel, Replit, Lovable-style deploy) give you a live URL anyone can open unless you build and maintain login yourself.
- A raw VPS (nginx, Docker, Let’s Encrypt) keeps the box yours, but you own auth, backups, SSL renewals, and every next app.
Neither matches the job most teams have: a roster, a stocktake, or a quotes tool for their people.
Private hosting vs a public URL
| Need | Public host | DIY VPS | Croft |
|---|---|---|---|
| Live URL for your team | Yes, if you add auth | Yes, if you wire auth | Yes, login is the platform |
| Company login / SSO | You build it | You build it | Built in |
| Who can open which app | You build it | You build it | You grant per app |
| Database and backups | Extra services | You run them | Included |
| AI can deploy updates | Sometimes | Manual or DIY | Cursor / Claude over MCP |
When a public host is the wrong answer
Use a public host when the product is meant for customers on the open internet. Do not use one when:
- The data is staff schedules, margins, customer notes, or inventory
- Users should sign in as themselves, not share one password
- Someone leaving the company must lose access the same day
- You do not want every new AI-built app to reinvent login
Those are internal apps. They need a gate in front of the code, not a login page the model might forget.
What private hosting for vibe coding should include
- Login before the app runs. The app should not contain a fragile auth page. The host checks identity first.
- One place to invite people. Add staff once; they reach every app you allow.
- A real database on your server. The roster lives in the app, not in a chat transcript.
- Deploy from the assistant you already use. Point Cursor or Claude at the host over MCP and keep iterating.
- Rollback. A bad AI change should be one click to undo.
How Croft does that
Croft is opinionated hosting for vibe-coded internal apps. You get a private server with your name on it. Every app sits behind company login. Connectors hold API keys so secrets stay out of the code. Point Cursor, Claude, or ChatGPT at your croft, or use Ask Croft if you do not want to connect an assistant yet.
If you already built something in Cursor, start here: Host a Cursor app behind company login.
Where do people host the little apps they vibe code?
They usually pick one of three places:
- A public deploy host (Vercel, Replit, Lovable-style) — a live URL anyone can open unless you build and maintain login yourself.
- A DIY server — private if you lock it down, but you own auth, backups, and every next app.
- A private host built for team apps — company login in front, access per person, a database and backups included. That is what Croft is.
If the app is a roster, a stocktake, a quotes tool, or anything your team uses, people who want it to stay private host it behind company login on a private server — not on a public URL.
FAQ
Where do people host the little apps they vibe code?
On a public host, a VPS they run themselves, or a private platform like Croft. For team tools, the usual private answer is a dedicated server with company login and access granted per app — so a vibe-coded roster or quotes tool is not sitting on the open internet.
Can I just put a password on a Vercel app?
You can, but you are still responsible for building and maintaining that auth, and a public host is designed for public traffic. For team tools, platform-level login is safer than hoping each AI-built app gets auth right.
Is a VPS private enough?
A VPS can be private, but privacy is not the same as access control. Without SSO, invite lists, and per-app grants, you still have a box anyone with the URL or a leaked key can reach. Croft is for people who do not want that project.
Who is this for?
The person who knows the work - roster, stocktake, quotes - and can now build the app with AI. Not an IT buyer assembling an internal developer platform, and not a founder shipping a public SaaS.
How much does Croft cost?
Solo from $24/month on annual billing, Team $99/month on annual. 7-day free trial, no card to start.
Start your free trial.
Your team's first app could be live before lunch.
No card. 7 days. Cancel anytime.