AI app builder
From Bolt.new to production
Last verified: June 2026· Bolt.new productionization
What you typically have on day 0
The Bolt.new prototype is in roughly the same state for every team we've worked with. The good news: the production work is predictable.
- Working prototype on Bolt's hosting, or self-hosted on Vercel / Netlify
- Auth: bolt-generated auth (often in-memory, or a third-party like Clerk or Auth0)
- Data: Bolt-generated SQLite, or a Supabase / Postgres instance, with no migrations
- No CI/CD, no staging environment, no rollback story
- AI-generated API routes in the same repo as the front-end, with no rate limits
- No observability beyond Bolt's hosting dashboard
The 12-axis production gap
For each of the 12 axes we score on every engagement, here's what Bolt.new typically has, and what production needs.
| Axis | What the prototype has | What production needs |
|---|---|---|
| Auth | bolt-generated auth or Clerk / Auth0 basic | SSO (SAML or OIDC); MFA; RBAC; session handling; audit logs; production-grade secret management. |
| Data | SQLite, Supabase, or generated Postgres | Migrations in version control; backups with a tested restore; per-route cost; per-environment separation (dev data ≠ staging data ≠ production data). |
| APIs | Bolt-generated API routes in the same repo | Versioned (/v1/); rate limited; idempotent on writes; documented (OpenAPI); error contracts. |
| Observability | Bolt hosting dashboard only | Per-route latency, error rate, cost; SLOs; alerting; same observability stack as the rest of production. |
| Security | No SAST, no secret scan, no pen test | AI-aware SAST in CI; secret scan; dependency audit; threat model; CSP and CORS hardening. |
| Compliance | None | SOC 2 evidence trail; GDPR; HIPAA if healthcare; documented data flow. |
| DevOps | Single environment, Bolt hosting | CI/CD; multiple environments; secrets manager; rollback story; status page. |
The relevant Bolt.new surface
Bolt Pro / Team → Adds private projects, larger compute, and team collaboration. The production hardening is still on you.
The engagement
A 3–6 week hardening pass covers the 12 axes above. Same engineers we use for the LLM cost work + the AI-coding rollout + the Supabase productionization. The engagement ships:
- A 12-axis production-readiness scorecard marked "production" for every axis
- A production-grade auth, data, API, observability, security, and compliance layer — in your repo, owned by your team
- A runbook, a threat model, a compliance matrix, an audit artifact
- Named internal owners per axis; the team owns the system after we leave
Related
Frequently asked questions
How long does it take to take a Bolt.new prototype to production?
A focused 3–6 week hardening pass covers the 12-axis rubric end-to-end. Small prototypes (single service, single team) take 3 weeks; larger prototypes (3+ services, multiple teams) take 6 weeks.
Do I need to keep using Bolt after production?
You can — the Bolt workflow is fast for UI iteration. But most production teams outgrow Bolt for the backend (auth, data, observability) and self-host on Vercel + Supabase / Postgres. The Bolt workflow becomes the front-end; the production work is layered on top.
What about the AI-generated API routes?
Bolt-generated API routes are functional in the demo. In production they need the same treatment as any API: versioning, rate limits, idempotency, OpenAPI docs, error contracts. Often the right answer is to refactor the AI-generated routes into a small dedicated service (Encore, Express + Postgres, or Hono).
What is the realistic cost of productionizing a Bolt prototype?
Fixed-scope: $25–60k for a 3–6 week engagement. Outcome-priced: 10% of first-year production revenue uplift.