560,000 New Apps in Six Months. How Does Yours Get Noticed?

Last week I wrote that when anyone can build an app in a weekend, most new apps will find no one. I said it was a guess.

It isn’t really a guess any more.

Twice the apps, almost the same downloads

About 600,000 new apps arrived on Apple’s App Store in 2025, up 30% on the year before. In the first six months of 2026, another 560,000 arrived. That’s nearly a whole year’s worth in half a year. Those numbers are Sensor Tower’s estimates, reported by The New York Times in July.

Here’s the part that matters if you’ve built one of them. Over the same six months, App Store downloads grew 2%.

Twice as many apps. Almost the same number of people downloading them.

And that’s only Apple’s store. Plenty of apps built with Lovable, Bolt or Replit never go near an app store. They’re websites with a login, shared on LinkedIn or in a Facebook group. Reported figures for Lovable alone run from 100,000 to 200,000 new projects started every day. Most of those will never be finished, let alone launched. But the ones that are launched are all asking the same people for the same few minutes of attention.

Why “just market it” isn’t enough

Getting noticed is half of it. The other half is getting someone to actually sign up.

Think about what you’re asking a stranger to do. Sign up to an app they’ve never heard of, built by someone they don’t know, probably in a few weeks, and type in their email, their business details, sometimes their customers’ details.

They’re right to hesitate. In a 2025 study, Veracode tested AI-generated code on security-sensitive tasks across more than 100 AI models, and 45% of the results contained a well-known kind of security flaw. The same year, a researcher scanned 1,645 apps built with Lovable and found about 1 in 10 let anyone read or change data they shouldn’t have, including usernames, emails and payment status. (Lovable disputes treating that as a flaw in Lovable itself, and says each app’s owner is responsible for protecting its data.)

None of that means your app is unsafe. It means a stranger can’t tell either way. And when they can’t tell, most of them close the tab.

What I built: Checked apps

So I built two things into Verilay, and they work together.

A directory of apps built with AI tools: Checked apps. Every app in it has been through a Verilay scan. That’s the only way in. Visitors can search by what they need (“bookings”, “quotes”, “home build”), filter by the tool it was built with, open the app, or contact the person who built it.

A stamp for apps that pass. If the scan finds no critical issues and grades your app A or B, your listing carries a green stamp, Checked · No critical issues, with the date. You also get the same stamp to put on your own site, with copy-and-paste code for your footer or your GitHub README.

A few details I cared about:

• The stamp keeps itself honest. It’s drawn live every time someone sees it. A check older than 90 days turns amber and says Expired · Due for a fresh check. If a listing is removed, the stamp says so too. Nobody can show a green stamp for an app that’s moved on.
• Your email stays private. Your listing shows your name, never your email address. When someone uses “Contact the builder”, I email their message to you, and you reply to them directly.
• Every listing is checked by a person before it appears. That’s me, for now.
• It’s free. The scan, the listing and the stamp.

How to get your app in

1. Run a free scan of your app’s public GitHub repository at verilay.dev.
2. If it finds issues, use the fix prompts in your report with your AI builder, then scan again. This is the part that actually makes your app safer. The stamp is just the proof you did it.
3. When the scan finishes, click List my app and fill in the short form.
4. Once it’s approved, I’ll email you the link to your app’s page, with your stamp code if it passed.

What the stamp is not

I want to be straight about this, because a badge that overpromises is worse than no badge.

• It’s not a certificate, a guarantee or a penetration test. It means a Verilay scan of your code found no critical issues on the date shown. Verilay’s findings are written by AI and can vary between runs.
• It checks your code, not everything around it. How your hosting is set up, settings that live outside your code, and how your app behaves under a real attack are not things a code scan can see.
• Only public GitHub repositories, for now. If your code is private, you can’t list it yet.
• Apps that don’t pass can still be listed. They just don’t get the stamp, and nothing on their listing says why. Fix the issues, scan again, list again, and the stamp appears.

Be one of the first

My own apps are the first in the directory, and it’s still small. That’s fine. I’d rather have ten real, checked apps than a thousand nobody looked at.

If you’ve built something with Lovable, Bolt, Replit, Cursor or any other AI tool, run a free scan and list it. And if you think I’ve got the stamp wrong, too strict, not strict enough, or missing something you’d want to see, tell me at [email protected].

Sources

• App Store numbers: Sensor Tower estimates, via The New York Times, reported by 9to5Mac, 20 July 2026.
• Veracode 2025 GenAI Code Security Report.
• The scan of 1,645 Lovable apps (CVE-2025-48757, disputed by Lovable): Superblocks write-up.
• Lovable project figures come from secondary reports and vary, for example tech-insider.org.