Guides / Bolt.new app launch checklist

Bolt.new app launch checklist

Updated November 3, 2026

Bolt.new can build and deploy a full app from a prompt. Before you post the link anywhere, run through this list. Most items take a few minutes each.

Security

• Secrets out of the frontend. Anything in client code is public. In Vite-based projects, any variable prefixed VITE_ is bundled into the browser JavaScript, so never put a secret key in a VITE_ variable. Keep secrets in server-side functions.
• Database rules. If your app uses Supabase, turn on Row Level Security for every table and write policies (see the RLS checklist).
• No exposed files. Confirm /.env, /.git/config and source maps (.map files) aren't downloadable from your live domain.
• HTTPS and headers. Your host should serve HTTPS only. Add security headers (CSP, HSTS, X-Content-Type-Options) through your host's config.

Google and share previews

• A unique <title> and meta description that say what the app does.
• Open Graph tags (og:title, og:description, og:image) so links look right on X, LinkedIn, Slack and iMessage. A 1200×630 image is the common size.
• A robots.txt and sitemap.xml, and a canonical URL pointing to your real domain.
• Replace the default favicon and page title the template shipped with.

Mobile

• Open the live site on a real phone. Check that nothing scrolls sideways, text is readable without zooming, and buttons are easy to tap.
• Make sure the viewport meta tag is present.

Speed

• Run Lighthouse (Chrome DevTools → Lighthouse) in mobile mode.
• Compress large images and serve them at the size they're displayed.
• Remove unused libraries the AI pulled in along the way.

Accessibility

• Every image has meaningful alt text (or empty alt if decorative).
• Form fields have labels, and icon-only buttons have an accessible name.
• Text has enough contrast against its background.

Links and content

• Click every link in the nav and footer. Look for 404s and links still pointing at a preview domain.
• Remove placeholder text, sample data and "lorem ipsum."
• Add a privacy policy and terms if you collect emails or take payments.

Before you announce

• Connect your custom domain and make sure the old preview URL isn't the one people find.
• Test sign-up, login, password reset and payment end to end, in a private window.

More guides: Is my Lovable app secure? · Supabase RLS checklist · Exposed API keys: how to check · Pre-launch checklist: Cursor, v0, Replit