Bolt.new app to production
Your Bolt.new app works and people use it. This guide covers what you can take out of Bolt, what usually breaks once real users arrive, and what it costs to make it production grade.
What you can take out of Bolt
Good news first. Bolt.new generates real code, usually a React and Vite frontend, often with Supabase behind it. You can connect the project to GitHub and keep it in sync, or download it as a ZIP. Either way you leave with a normal codebase that any engineer can open.
The code is the easy part to move. The accounts around it are not. Check who owns the Supabase project, the domain, the Stripe account and every API key the app uses. If any of them were created inside a tool session or under a personal email, move them to company accounts you control before you change a single line of code.
Bolt can deploy to Netlify in 1 click. That is fine for previews and early users. For production you want a deploy pipeline you own, with environments for staging and production and a way to roll back.
What breaks first in a Bolt.new app
- Row Level Security. Supabase ships its anon key to the browser by design. That is only safe if every table holding user data has a policy. In generated apps many tables have none, so any logged-in user can read any row.
- Secrets in the frontend. OpenAI, Stripe or service keys end up in the client bundle where anyone can read them in developer tools. They belong in server functions.
- Auth gaps. Password reset, email verification, rate limits on login and real roles are often missing. Everyone ends up an admin.
- A data model built feature by feature. Duplicate tables, no foreign keys, and reports that need 40 queries where 1 should do.
- Zero tests. So every prompt that adds a feature can quietly break 3 others.
Step by step: Bolt to production
- Connect the project to a GitHub repository owned by your company and freeze changes in Bolt while you work.
- Move the Supabase project, domain and payment accounts to company ownership. Rotate every key that was ever in the frontend.
- Turn on Row Level Security for every table with user data and write a policy for each one. Test it with 2 normal user accounts.
- Move third-party calls and secrets into server functions or a small API layer.
- Fix auth: verification, reset, login rate limits and roles.
- Add tests for the 3 workflows that make you money, then CI that runs them on every change.
- Set up staging and production environments, error monitoring and daily database backups.
The 3 ways to production, and what each costs
- Harden in place, from $5,000, 2 to 3 weeks. Lock down the database, fix auth, move secrets to the server, add monitoring. The frontend stays as it is. Right when you have under a few hundred users and the product still changes weekly.
- Rebuild the backend, keep the front, $15,000 to $25,000, 6 to 8 weeks. New API layer, cleaned data model, real permissions, integrations moved server side, tests and CI. Right when users like the product but the plumbing cannot be trusted with money or personal data.
- Full production rebuild, $25,000 to $35,000, 8 to 10 weeks. Same product decisions on a new stack, UX fixes from real usage, AI features designed in. Right when you are charging money, growing, and know exactly what version 2 should be.
These are our fixed prices for this work, with full IP transfer.
When you should not move yet
If nobody pays yet and there is no waitlist, stay in Bolt. Fix Row Level Security and the exposed keys this week, keep shipping, and come back when someone asks to pay.
Frequently asked questions
Send us the app. Get a fixed plan.
Share your Bolt.new project and we reply with what to keep, what to fix and a fixed price.
Get my plan ↗