Bolt.new Launch Checklist

1. Know what VITE_ actually means

Bolt apps are usually Vite + React. Anything in an env var starting with VITE_ gets baked into the JavaScript that ships to every visitor. That's fine for public stuff (a Supabase anon key, a Stripe publishable key). It is not fine for secrets.

How to check: Open your live app → DevTools → Sources → search for sk-, sk_live_, service_role, VITE_OPENAI. Or paste your URL into ChillScan and we'll look for you.

If you find one: Rotate the key with the provider first (it's already public), then move the call behind a server function.

Find every environment variable with a VITE_ prefix. For each one, tell me whether it is safe to be public. Move any secret (OpenAI, Anthropic, Stripe secret, Supabase service_role, etc.) out of the frontend into a serverless function (Netlify Function or Supabase Edge Function) and call that from the app instead.

2. Put secrets where the browser can't reach them

Paid-API keys belong in your deploy target's environment settings (Netlify → Site configuration → Environment variables, or Supabase Edge Function secrets), read only by server-side code — without the VITE_ prefix.

Bonus: Add simple rate limiting to any function that calls a paid API so one curious visitor can't run up your bill.

3. Pick a deploy target and use your own domain

Bolt can deploy to Netlify in a click, and plenty of people export to GitHub and deploy on Vercel or Cloudflare Pages. Whichever you pick:

• Hook up a custom domain so your brand (and SEO) isn't tied to a random subdomain.
• Make sure http:// redirects to https:// in one hop, and nothing loads over plain HTTP.
• For single-page apps on Netlify, add an SPA fallback (/* /index.html 200 in _redirects) so deep links don't 404.

4. Add security headers with _headers or netlify.toml

Netlify reads headers from a public/_headers file or a [[headers]] block in netlify.toml. At minimum you want: Strict-Transport-Security, X-Content-Type-Options: nosniff, X-Frame-Options: DENY, Referrer-Policy: strict-origin-when-cross-origin, and a Content-Security-Policy (start in report-only mode).

See also what ChillScan checks for headers.

Add a public/_headers file (Netlify format) that applies these headers to all routes: Strict-Transport-Security max-age=31536000; includeSubDomains, X-Content-Type-Options nosniff, X-Frame-Options DENY, Referrer-Policy strict-origin-when-cross-origin, and a Content-Security-Policy-Report-Only that allows the domains this app actually uses. List the domains you included.

5. The SEO basics Bolt apps usually skip

Out of the box a Bolt app often ships with the template title and an empty <body> until JavaScript runs.

• Set a real <title> and meta description in index.html.
• Add Open Graph + Twitter tags and an OG image so shared links look good.
• Add robots.txt and sitemap.xml in public/.
• Check View Source: if your landing page copy isn't there, crawlers may see a blank page. A pre-rendered landing page helps a lot.

Update index.html with a real title, meta description, canonical URL, Open Graph and Twitter card tags (with a 1200x630 og:image). Add public/robots.txt and public/sitemap.xml listing the public routes. If possible, pre-render the landing page so its text is in the initial HTML.

6. Check auth and data access

If your Bolt app uses Supabase, Row Level Security needs to be on for every table — the anon key in the browser is only safe because of it. Log in as user A, change an ID in a request, and make sure you can't see user B's data.

Deep-dive in the Lovable security checklist (same Supabase rules apply).

7. Speed check

Vite bundles can get chunky as Bolt adds libraries. Lazy-load heavy routes, compress images, and drop unused dependencies. ChillScan reports response time, page weight and bundle size.

The Bolt pre-launch checklist

Copy this into a note before you share the link.

[ ] No secrets in VITE_ env vars (rotated if they ever were)
[ ] Paid-API keys live in server functions / deploy env settings
[ ] Rate limits on functions that call paid APIs
[ ] Custom domain connected, HTTP → HTTPS in one hop
[ ] SPA fallback so deep links don't 404
[ ] Security headers via _headers or netlify.toml
[ ] Real title, description, OG tags + image
[ ] robots.txt and sitemap.xml in public/
[ ] Landing page content in View Source
[ ] RLS on (if using Supabase), user A can't see user B
[ ] Mobile load feels fast