The Pre-Launch Checklist for Bolt-Built Apps (Learned From Two Hurried Launches)

Bolt is genuinely remarkable at the part it advertises: describing an app and watching it exist. My first two launches taught me the part it does not advertise, which is everything between 'it works on my machine' and 'strangers can use it.' This is the checklist I now run, and what each check caught.

Environment and secrets first: every API key in environment variables, never in client code, and the production database not the dev one. Check one exists because my first launch shipped a client-side key. Check two exists because the app politely emailed a test database that was, briefly, production.

The error-state sweep comes next, and it is the one AI builders systematically miss: every loading state, every empty list, every failed fetch, and the offline case. Generated apps are optimized for the happy path because that is what you demoed. Walk every screen asking 'what does the user see when this fails,' and you will find screens that fail into silence.

Rate limits and quotas deserve their own hour: what happens to the app when the AI provider rate-limits you, when the email quota caps, when the payment webhook retries. Bolt-built apps tend to assume infinite capacity because they were born in a sandbox. Graceful degradation is a feature you specify, not one that emerges.

The last three are unglamorous and non-negotiable: a real backup of the database, a rollback path (the previous deployment), and one full transaction tested with real money or a real signup on the production domain. My first launch skipped all three and survived by luck. The checklist exists so luck stops being a dependency.