Report

Should I Use Dyad?

dyad.sh·Analyzed 8 hours ago·9/20/2026·Based on 12 sources

Build full-stack AI apps on your desktop with Dyad, the free, local, open-source AI app builder. Use any AI model, own your code. Zero lock-in.

Depends

Depends

Buy if you're a technical builder who wants a free, local, no-lock-in way to generate full-stack apps with any AI model.

Free local AI app builder, zero lock-in — ideal for tinkerers; recent critical RCE and credit pricing are the catches.

Confidence: Medium

5.0/5

Product Hunt rating

4 reviews

$0

Starting price

Free, open source, runs locally

Yes

Free tier

Core local builder is free

$20–$79/mo

Paid plans

Pro and Max, AI credits

Value for money

5

Free core, open source, any model

Ease of use

4

Loved by users; local install needed

Feature depth

4

Full-stack, any model, VS Code integration

Security posture

2

Critical RCE CVE, patched quickly

Pros

Free, open-source, zero lock-in
Runs locally; your code and data stay yours
Works with any AI model^¹
Users call it a powerful free Lovable alternative^⁸
VS Code integration loved by users

Cons

Critical RCE vulnerability (CVE-2025-58766) hit v0.19.0^⁴
Pro pricing model criticized by users^⁹
Desktop install means setup friction versus hosted rivals^¹
Early v0.20 software; expect fast changes and rough edges^¹
Generated apps can ship vulnerable dependencies (75 npm vulns in one audit)^⁶

Gotchas

highCVE-2025-58766: critical RCE via preview window in v0.19.0. Update to v0.20.0+ before building anything.^⁴
mediumReddit users say the Pro pricing model 'needs to be rethought'; credit costs climb with heavy use.^⁹
mediumOWASP case study counted 75 npm vulnerabilities in one Dyad-generated app's lockfile — audit generated code.^⁶
lowPro/Max plans buy AI credits; heavy building costs extra beyond the free tier.^³

Best for

Indie hackers and hobbyists
Privacy-minded builders (fully local)
Lovable/Bolt refugees avoiding subscriptions
Devs wanting to own their code

Not for

Non-technical founders wanting hosted, one-click shipping
Teams needing SOC 2, SSO, or vendor SLAs
Security-sensitive production workloads (recent critical RCE)
Anyone unwilling to self-install and manage API keys

Pricing

Free

$0

Local, open-source app builder
Perfect for getting started

Pro

$20/mo

Added AI credits and features

Max

$79/mo

Highest credit allowance
Added capabilities

Security

One critical RCE (CVE-2025-58766) disclosed Sep 2025, patched in v0.20.0; keep updated and audit generated code.

CVE-2025-58766 — Remote Code Execution via preview windowCritical RCE in Dyad v0.19.0 through the preview window; fixed in v0.20.0.^⁴

What users say

Reddit users overwhelmingly praise Dyad as a free, powerful Lovable alternative, with recurring gripes about Pro pricing.

“I'm shocked. Dyad - A Free, Powerful Alternative to Lovable.”

— Reddit, r/dyadbuilders

“Dyad is an amazing tool!”

— Reddit, r/dyadbuilders

“I absolutely love Dyad!”

— Reddit, r/dyadbuilders

Alternatives

Compare Dyad with each alternative.

Lovable

Hosted AI app builder; easier start, less control

Dyad vs Lovable

Bolt.diy

Open-source builder; closest rival to Dyad

Dyad vs Bolt.diy

GitHub Copilot

AI coding inside your editor; steeper but standard

Full analysis

Based on 12 usable public sources; same-name products (Dyad game, Roborock vacuum, Dyad Inc. insurance platform) excluded.

Sources

Dyad – Free, Local, Open-Source AI App Builderdyad.sh
official
Dyad Pricing Plansdyad.sh
official
Dyad Pro – Pricing, Plans & AI Creditsdyad.sh
official
CVE-2025-58766 Detail - NVDnvd.nist.gov
security
Remote Code Execution via Preview Window (GitHub Advisory)github.com
security
Dyad Case Study | CVE Lite CLI (OWASP)owasp.org
security
Dyad Review 2026: Free Local AI App Buildernocode.mba
review
I'm shocked. Dyad - A Free, Powerful Alternative to Lovable (Reddit)reddit.com
review
Dyad pro pricing model need to be rethought (Reddit)reddit.com
review
Dyad for Mobile Apps - Native iOS & Android Guidenewly.app
news
Github Copilot vs Dyad | Which Vibe Coding Tools Wins In 2026?selecthub.com
review
Dyad Reviews (Product Hunt)producthunt.com
review

Rate this review

Anonymous. You can change your vote.

Loading votes…

Comments

One queue. No nested comments. Give a display name first. Limit: 200 words per comment and 7 comments per day. You can edit or delete yours.

No comments yet.

Depends

Buy if you're a technical builder who wants a free, local, no-lock-in way to generate full-stack apps with any AI model.

Who it's for

Indie hackers and hobbyists
Privacy-minded builders (fully local)
Lovable/Bolt refugees avoiding subscriptions
Devs wanting to own their code

Who it's not for

Non-technical founders wanting hosted, one-click shipping
Teams needing SOC 2, SSO, or vendor SLAs
Security-sensitive production workloads (recent critical RCE)
Anyone unwilling to self-install and manage API keys

Gotchas

CVE-2025-58766: critical RCE via preview window in v0.19.0. Update to v0.20.0+ before building anything.⁴
Reddit users say the Pro pricing model 'needs to be rethought'; credit costs climb with heavy use.⁹
OWASP case study counted 75 npm vulnerabilities in one Dyad-generated app's lockfile — audit generated code.⁶
Pro/Max plans buy AI credits; heavy building costs extra beyond the free tier.³

Pricing notes

Free: $0 — Local, open-source app builder; Perfect for getting started
Pro: $20/mo — Added AI credits and features
Max: $79/mo — Highest credit allowance; Added capabilities

Key capabilities

5.0/5 — Product Hunt rating (4 reviews)
$0 — Starting price (Free, open source, runs locally)
Yes — Free tier (Core local builder is free)
$20–$79/mo — Paid plans (Pro and Max, AI credits)
Value for money: 5/5. Free core, open source, any model
Ease of use: 4/5. Loved by users; local install needed
Feature depth: 4/5. Full-stack, any model, VS Code integration
Security posture: 2/5. Critical RCE CVE, patched quickly

Security notes

One critical RCE (CVE-2025-58766) disclosed Sep 2025, patched in v0.20.0; keep updated and audit generated code.

CVE-2025-58766 — Remote Code Execution via preview window. Critical RCE in Dyad v0.19.0 through the preview window; fixed in v0.20.0.⁴

What to use instead

Lovable — Hosted AI app builder; easier start, less control https://lovable.dev
Bolt.diy — Open-source builder; closest rival to Dyad https://bolt.diy
GitHub Copilot — AI coding inside your editor; steeper but standard https://github.com/features/copilot

Sources

1.Dyad – Free, Local, Open-Source AI App Builder https://www.dyad.sh/
2.Dyad Pricing Plans https://www.dyad.sh/plans
3.Dyad Pro – Pricing, Plans & AI Credits https://www.dyad.sh/pro
4.CVE-2025-58766 Detail - NVD https://nvd.nist.gov/view/vuln/detail?vulnId=CVE-2025-58766
5.Remote Code Execution via Preview Window (GitHub Advisory) https://github.com/dyad-sh/dyad/security/advisories/GHSA-7fxm-c5xx-7vpq
6.Dyad Case Study | CVE Lite CLI (OWASP) https://owasp.org/cve-lite-cli/docs/case-studies/dyad
7.Dyad Review 2026: Free Local AI App Builder https://www.nocode.mba/articles/dyad-review
8.I'm shocked. Dyad - A Free, Powerful Alternative to Lovable (Reddit) https://www.reddit.com/r/dyadbuilders/comments/1piykuw/im_shocked_dyad_a_free_powerful_alternative_to/
9.Dyad pro pricing model need to be rethought (Reddit) https://www.reddit.com/r/dyadbuilders/comments/1m87d0c/dyad_pro_pricing_model_need_to_be_rethought/
10.Dyad for Mobile Apps - Native iOS & Android Guide https://newly.app/dyad-for-mobile-apps
11.Github Copilot vs Dyad | Which Vibe Coding Tools Wins In 2026? https://www.selecthub.com/vibe-coding-tools/github-copilot-vs-dyad/
12.Dyad Reviews (Product Hunt) https://www.producthunt.com/products/dyad-free-local-vibe-coding-tool/reviews