AI App Builder Audits · AI Development Series
Bolt App Audit
Bolt will build you almost anything in almost any framework. That flexibility is its strength, and it is also why no two Bolt applications have quite the same problems.
What Bolt actually hands you
Bolt, made by StackBlitz, runs an entire development environment inside your browser using WebContainers. There is no setup and nothing to install, which is a genuinely clever piece of engineering and a large part of why it feels so frictionless.
What a Bolt application is made of
- Frontend React, Vue, Svelte or Astro, depending on what it chose
- Runtime Node, running in the browser via WebContainers
- Database Commonly Supabase, meaning PostgreSQL
- Mobile Expo and React Native, where mobile is in scope
- Deployment Typically Netlify or another static or edge host
- Export Full source download, or push to GitHub
The framework flexibility is the thing that makes Bolt different to audit. With Lovable you know before you open the repository that you are looking at React on Supabase. With Bolt you might be looking at a Svelte application, an Astro site with a handful of API routes, or a full Vue project — and each of those has different conventions for where authentication lives and what runs on the server versus in the browser.
The other thing worth understanding is that the browser environment it builds in is not the environment it eventually runs in. Things that worked in the WebContainer can behave differently once the application is deployed to a real host, particularly anything touching the filesystem, environment variables or long-running processes.
What we consistently find
Because Bolt picks a stack per project, what we find varies more than with other generators. These four come up regardless of which framework it chose.
Security logic on the wrong side of the browser
Every framework Bolt uses has a clear line between code that runs on your server and code that runs on the user's machine. Generated code frequently puts checks on the wrong side of it — filtering a list in a component, hiding a route in the router, or deciding what an administrator can see using a value held in browser state.
All of that is visible and editable by anyone who opens developer tools. If the same rule is not independently enforced by the database or an endpoint, it is decoration rather than protection.
What it costs you: users reaching data and actions that were meant to be restricted.Supabase policies left open
Where Bolt has wired up Supabase, the same issue that dominates Lovable applications applies here: row level security either switched off, or switched on with a policy permissive enough to let any signed-in user read any row.
It is invisible while you are the only user, because you only ever see your own data anyway. It becomes a breach the moment you have a second customer.
What it costs you: customer data exposed to other customers, reportable to the ICO under UK GDPR.Works in the container, breaks on the host
Applications built entirely inside a browser-based environment tend to carry assumptions that do not survive deployment: writing files to local disk, holding state in memory between requests, or relying on a process that stays running.
On a static or serverless host, several of those simply are not true. The symptom is an application that behaved perfectly during the build and then loses data, forgets sessions or fails intermittently once it is live.
What it costs you: faults that only appear in production, where they are hardest to diagnose.A stack nobody in your team knows
This one is commercial rather than technical. If Bolt decided to build your application in Svelte and everyone you are likely to hire writes React, you have quietly taken on a recruitment problem alongside a codebase.
None of these frameworks is a bad choice. The question is whether the choice was made deliberately, and whether the people who will maintain it can. Part of the report is simply telling you what you have got and what it will take to look after it.
What it costs you: difficulty hiring or handing the project over later.Where Bolt is genuinely good
Bolt is one of the better tools in this category. It produces real, downloadable code with no proprietary format, it does not lock you in, and the browser environment removes an enormous amount of the friction that stops people building at all.
Genuinely well suited to
- Rapid experiments where setup time would be most of the work
- Prototypes and demos that need to exist by tomorrow
- Trying an approach in a framework you do not normally use
- Single-user internal tools
- Producing a working reference for developers to build from properly
Where it needs engineering behind it
- Multiple separate customers whose data must never mix
- Anything holding personal data, health data or payment details
- Applications that must behave identically in production and in testing
- Anything your business would genuinely suffer without
- Codebases your team will have to maintain for years
The honest summary: Bolt gets you moving faster than almost anything else, and it hands you real code at the end of it. What it does not do is decide what should run where, or check that the database is enforcing the rules your interface implies.
Prefer to watch? The short version of who we are and how we work
Do you need an audit?
Get it looked at if
- More than one customer or organisation uses it
- It stores personal data of any kind
- It takes payments or sits near anything that does
- It behaves differently live than it did while you were building it
- You are not sure which framework it actually used
You are probably fine if
- You are the only person who uses it
- It holds nothing you would mind losing or leaking
- It is still a prototype and everyone treats it as one
- It is a throwaway you will rewrite when the idea is proven
Questions about auditing a Bolt build
Not at all, and you are far from the only one. Working that out is the first thing the audit does, and it is genuinely useful information: it determines who you can hire, what it will cost to maintain, and where the security boundaries in your application are meant to sit. You do not need to know before you come to us.
The code, either as a download from Bolt or pushed to a GitHub repository you control, and read-only access to the database if it is using one. We do not need your Bolt account, we will not deploy anything, and we will not change your application.
No, and we would rather say so plainly than pretend otherwise. We build with Claude Code and Cursor, with senior developers designing the system, reviewing every change and testing it. What makes us useful here is not Bolt expertise, it is that Bolt produces React, Vue, Svelte, Node and PostgreSQL, which is what we have been building and fixing for years.
Built with something else?
We audit what these tools produce, whichever one you used.
Other AI app builders
- Lovable app audit
- Emergent app audit
- Replit app audit
- UI Bakery app audit
- v0 app audit
- Base44 app audit
- Firebase Studio app audit
- Databutton app audit
- Rork app audit
- a0.dev app audit
- FlutterFlow app audit
- Bubble app audit
- Glide app audit
- Softr app audit
- Adalo app audit
- Retool app audit
- Appsmith app audit
- Budibase app audit
- ToolJet app audit
- Xano app audit
- Airtable app audit
The audit
Find out what you are sitting on
The AI Code Audit is £495, fixed.
Tell us roughly what you built and how many people use it. If an audit is not the right thing for you, we will say so.
What the report covers:
- What stack you have actually ended up with, and what that means
- Security and access control, including anything enforced only in the browser
- Database structure and whether it fits the business
- What will behave differently in production than it did in the builder
We reply within one working day.
