By Bolt apps usually need three things before real users: code that runs outside Bolt, secrets moved to the server, and database rules that keep each user's data private.
What Bolt builds
Bolt.new, from StackBlitz, builds and runs full-stack JavaScript apps in the browser. Projects often use Supabase or Bolt's own database for data and sign-in, and deploy with one click.
Where Bolt apps usually break
The code lives in a Git repository you own
Connect GitHub or export the project. If the builder account is lost, the product should not be.
Access rules are on for every table
In Supabase, open Table Editor: every table should show RLS enabled, with at least one policy. In Firebase, your rules should never say allow read, write: if true.
No secret keys reach the browser
Open your live app, then DevTools, Sources, and search the loaded JavaScript for sb_secret_, sk_live_, sk-proj- and sk-ant-. Older Supabase keys are long tokens starting with eyJ: decode the middle part of each on your own machine, and if it contains "role":"service_role", your secret key is public. A publishable or anon key in the browser is expected.
Testing and real users use separate databases
Experiments and AI agents should never run against production data.
Secrets live in the host's environment settings
Keys belong in environment variables on the server, not in the repository or in front-end code.
Input is validated on the server
Forms that only check input in the browser accept anything sent directly to the API.
Check it yourself
- Export the project or push it to GitHub, then confirm it installs and runs on a normal machine with
npm installandnpm run dev. - Find every key in the code. Move secrets to environment variables on your host.
- If the app uses Supabase, run the checks in our Supabase guide.
- Set up a separate database for testing so experiments do not touch real users' data.
When to call an engineer
Call an engineer when the project only runs inside Bolt, when secrets are in the code, or when the app needs payments, roles or integrations Bolt keeps getting wrong.
A one-off check costs $49 to $800. Fixing and hardening an app costs $1,500 to $15,000 and takes 1 to 8 weeks, based on the prices companies publish.
Top-rated companies for Bolt apps
Ranked by our score: published prices, scope of work, AI tools named, timing and a low-risk first step. How we score.
- 1Afterbuild Labs10.0/10Best for: A check before launchFree first step · from $49
- 2Redlab10.0/10Best for: A full rescue by one team that keeps buildingFree first step · from $490
- 3Vibe Code Rescue (Lev Arakelyan)9.0/10Best for: A one-off check and a cleanupFrom $299
Questions
Can a Bolt project run without Bolt?
Yes. It is standard JavaScript, usually React with Vite or a similar setup, and can be exported and deployed to any Node-capable host.
My Bolt app broke after I added payments. What do I check first?
Whether the server, not the browser, confirms each payment: Stripe must call a webhook that your app verifies before it unlocks anything. Then run a successful, a failed and a repeated payment in Stripe test mode before you turn live checkout back on.