Bolt app launch checklist

A step-by-step checklist for launching an app you built with Bolt, written for people who don't code.

You built something with Bolt and it works. This checklist covers what to check before you share the link with the world. Work through it top to bottom. The first sections protect your users and your wallet. The last ones make your launch look finished.

Before you publish

Use the real address. Publish your app and share the published link (your .bolt.host address or your own domain), not the editor preview.
Connect your own domain if you have one. A custom domain looks more trustworthy than a random address. Bolt lets you add one in your project's domain settings.
Click every button once. Sign up, log in, log out, reset your password, and complete any payment flow on the published site, not just in the preview.

Protect your users' data

Find out where your data lives. Ask Bolt: "Where does this app store its data, and is every table protected so users can only see their own data?"
If you use Supabase, look for "Unrestricted". Open the Supabase Table Editor. A red Unrestricted label means anyone can read and change that table. Ask Bolt to turn on Row Level Security for it and add policies.
Run the second-account test. Sign up with a second email in a private window and try to view the first account's data. If you can, so can strangers.
Check pages that need a login. While logged out, type in the address of your dashboard or admin page. It should send you to log in.

Protect your wallet

Keep secret keys out of the app. Your OpenAI key, your Stripe secret key (sk_live_...), and any "service role" or "secret" key must never be in the code that runs in the browser. Ask Bolt: "Are any secret API keys used in frontend code? If so, move them to a server function."
Set spending limits. In your OpenAI, Anthropic, or other paid API dashboards, set a monthly budget or usage limit. If something goes wrong, the limit caps the damage.
Limit how often people can use expensive features. If your app sends emails or calls a paid API, ask Bolt to add a limit, like "10 requests per user per minute."

Make it look finished

Page title and description. Search results and link previews use these. Ask Bolt to add a clear title and a one-sentence description to the homepage.
Link preview image. Paste your link into a chat with yourself. If there's no image or it says "Vite + React", ask Bolt to add an Open Graph image.
Favicon. The little icon in the browser tab. The default one tells people the app is unfinished.
Works on a phone. Open the site on your phone. Text should be readable without zooming, and buttons should be easy to tap.
A 404 page. Visit a made-up address like /this-does-not-exist. You should see a friendly page with a link home, not a blank screen.

Be findable

robots.txt and sitemap. These help search engines find your pages. Ask Bolt to add both.
Real text on the homepage. Say what your app does in plain words near the top of the page.

After launch

Have a way to hear about problems. A contact form or email address on the site.
Re-check after big changes. Every new feature can undo an earlier fix. Run the second-account test again after each big update.

Print this list, or keep it open in a tab, and tick off each item before you post your launch.