Bolt app launch checklist
Bolt.new apps usually run perfectly in the WebContainer preview, then hit trouble on the first real deploy: missing env vars, dependency conflicts, or a database that anyone can read. Here's what to check before you share the link.
We scanned 21 public vibe-coded apps: 57% had at least one Supabase policy open to everyone, 62% had committed a .env file, and 24% failed a clean npm install. The average launch health was 63/100.
01It builds outside Bolt
- Download or push the project to GitHub, then run
npm ci && npm run buildin a fresh folder. That's what Netlify/Vercel do. - If install fails with
ERESOLVE, fix the conflicting versions rather than relying on--force. A quarter of the apps we scanned failed here. - The lockfile (
package-lock.json) is committed, so your host installs the same versions you tested. - The build output folder (
dist) and build command match your host's settings.
02Environment variables
- Every variable your code reads (
import.meta.env.*) is set in the host's dashboard. Missing ones are the #1 cause of a blank page after deploy. - A
.env.exampledocuments each one..envitself is ignored by git. - Anything prefixed
VITE_is visible to every visitor. Only public keys go there.
03Database and secrets
- If you use Supabase: RLS is enabled on every table, and no policy uses
using (true)on private data. - No secret keys (OpenAI, Stripe secret, service_role) in the frontend. Move those calls into a serverless/edge function.
- Secret-scan the git history, and rotate anything that was ever committed.
04Launch polish
- Errors are handled: failed requests show a message, and an error boundary catches crashes.
- SPA routing works on refresh (add a
_redirectsorvercel.jsonrewrite toindex.html). npm auditshows no critical vulnerabilities.- Page title, favicon and social preview image are set (not "Vite + React").
Don't want to check all this by hand?
Paste your GitHub link. VibeHP runs every check on this page (plus a git-history secret scan and a real build) and gives you an HP score out of 100, with a copy-paste AI prompt for every fix.
Check my HP for $19 →One-time · Your code is deleted right after the scan
FAQ
Why does my Bolt app work in preview but fail on Netlify?+
Usually missing environment variables, a dependency conflict that only shows up on a clean npm install, or missing SPA redirects. Run npm ci && npm run build locally to reproduce it.
Is it safe to put my API key in a VITE_ variable?+
Only if it's a public/publishable key. VITE_ variables are bundled into the JavaScript every visitor downloads.
Do I need Row Level Security with Bolt + Supabase?+
Yes. Without RLS, anyone with your public anon key (which is in your frontend) can read and modify those tables.