---
title: A custom domain can hide the builder from your customers
author: Giacomo Balli
published: 2026-07-13
url: https://BigBalli.com/blog/a-custom-domain-can-hide-the-builder-from-your-customers
tags: Engineering, Product, Leadership, Security, Reading
---

# A custom domain can hide the builder from your customers

*By Giacomo Balli* | *Published: July 13, 2026*

A custom domain can hide the builder from your customers.
It cannot hide it from the internet.

Production apps built on Lovable, Replit, or Base44 often leave a useful fingerprint in public DNS.

Connecting a custom domain requires a verification TXT record. That record can contain the platform name in plain text, remains world-readable, and may need to stay in place for certificate renewal.

I pulled TXT records for 1.8 million domains with real traffic and matched those fingerprints.

219 hits.

208 were still serving traffic.

More than half of the live apps responded to a first-party API. These were generated routes, rather than managed Supabase endpoints that can be patched centrally.

A few exposed their entire admin section to a request with no login.

Picture the Monday morning security review: the team thinks it needs to audit a known application. An attacker gets to start one step earlier, by identifying thousands of apps built with the same tooling and testing the assumptions that tooling tends to produce.

That changes the economics of a small security mistake.

Generated software makes shipping cheaper. It can also make finding repeated mistakes cheaper.

If you shipped this way, assume your stack is discoverable. Security through obscurity just got a DNS record.

[Discuss on LinkedIn](https://www.linkedin.com/feed/update/urn:li:activity:7499094571650416640)

---

**Tags:** Engineering, Product, Leadership, Security, Reading

---

*View the [HTML version](https://BigBalli.com/blog/a-custom-domain-can-hide-the-builder-from-your-customers) of this post.*