Key findings
- Speed to a first working app draws the most consistent praise: 23 of the 26 accounts that discuss it got there quickly.
- Fix-and-break loops and token spend draw the most complaints. 15 of the 18 accounts that discuss loops call them a problem, as do 13 of the 17 that discuss tokens, and 7 of 8 say quality falls as the app grows.
- 9 accounts run Bolt-built apps in production and 3 keep Bolt to prototypes. The 3 team and leadership accounts that say where the code ends up lean to prototypes, 2 to 1.
- Moving the code out works for most who try it. 6 of the 8 accounts that took it to GitHub, another host, or an editor such as Cursor say the move went well.
- An outside scan published in April 2026 found critical Supabase data-access issues in 21 of 289 bolt.host apps, or 7.3%.
Bolt gets builders to a first working app fast, and the cost arrives later in fix loops and tokens once the app grows past a few features. Teams that keep Bolt move the code to GitHub and an editor before the app needs regular care. Treat any bolt.host app that reads company data as unreviewed until an engineer checks its database rules.
Who builds, and what
Most accounts come from individual developers, product people, designers, and founders building first versions. Their projects include a Chrome extension, a workout summary site, a clinic comparison site, a children's iOS drawing app, and a Zillow data tool for a client. 7 speak for teams. At Ramp, designers and PMs prototype in Bolt on Ramp's own design system to get user feedback before engineering takes over. The team first worked with StackBlitz to stop Bolt falling back to public component libraries. In one Hacker News account, a team's product owners and architects prototype epics in v0, Lovable, and Bolt to agree requirements with the business, then discard the code. A solo developer at a healthcare agency describes the CEO sketching UI ideas in Bolt on the developer's own React stack. Valtech's EU design team ran Bolt and Lovable on the same pharmaceutical dashboard brief and found Bolt steadier on vague prompts and weak at Figma import.
Bolt's own customer story, which is vendor material, says Digital Virgo's CTO built a cross-platform streaming app with Bolt as the main tool. The company's Bolt seats grew from 50 to nearly 70 within a year.
Where it saves time
The first version arrives in minutes or hours. One builder built and deployed a workout summary site with Netlify in under an hour. A consultant built a client's Zillow data tool with Stripe payments in about three days without writing code. Bill Prin took an Expo flashcard app from idea to the App Store in about six tracked hours.
Builders credit the database wiring. Bolt creates tables, sign-in, and server functions for them in Bolt Database or Supabase. The Zillow tool's Edge Functions ran to about 1,100 lines, though its builder had to ask for the locking that prevents double charges. Addy Osmani trusts Bolt to produce good UI with little back and forth.
Where it stalls
As apps grow, fixes start breaking other parts. One builder says real apps collapse after the second or third feature. A reviewer of AI tools found every trial app ended in a loop where each fix brought back an earlier break. A builder on a 15,000-line app sees fixes bring back old bugs. One builder launching a startup app says Bolt spent 10M tokens on changes nobody requested and left function remnants that broke payments at launch.
Bolt reads the project on every message, so loops cost tokens as well as time. One builder calls Bolt a token hog that can drain a million tokens on one instruction, and Roger Wong ran out of credits on two blank results from the same prompt. Another builder paused a project and lost the saved tokens after two months.
Security and data
securityscanner.dev's scan of bolt.host put Bolt's rate of critical Supabase access issues about level with Lovable's and above Replit's. The researchers judged most of the flagged apps to be quick prototypes deployed once and forgotten. Apart from the payment break at launch above, GILD found no first-hand security reports from builders. Run Bolt's security audit and have an engineer check database rules before an app takes real users.
Paid plans now include a token-free security audit of code and database from the Publish menu. Separately, StackBlitz's privacy policy lets Bolt train models on content created from October 7, 2026, and license de-identified datasets built from it. This covers individual accounts outside the EU, UK, and Switzerland unless the user opts out. For a company, that setting matters more than any one app.
What builders who kept it changed
The builders who kept Bolt narrowed what it does. Several start in Bolt and finish in Cursor, Claude, or Google Antigravity once the app needs care. Others write planning documents before the first prompt and revert before fixes pile up. Some build one component at a time and wire Supabase last, and one exports the code after each change to catch files Bolt rewrote.
- Write the plan and the stack down before the first prompt.
- Revert from version history when two or three fixes fail.
- Connect GitHub early and finish complex work in an editor or coding agent.
- Have an engineer review database rules and payments before launch.
Methodology
GILD read the 67 public accounts behind this report, published from January 2025 to October 2026 and opened on October 12 or 25, 2026. They comprise 34 Hacker News comments and threads and 20 r/boltnewbuilders posts read through Arctic Shift. The remaining 13 are newsletters and blog posts, a dev.to post, security research, an outside test, GitHub issues, and X posts. Every count describes these accounts only. Digital Virgo's figures are Bolt's own, from its customer story. GILD checked product behavior against Bolt's Help Center on the same dates.
Products in this piece
Sources
- Public source
- 22
- Official documentation
- 6
- Hacker News thread by skipsterdev on a Chrome extension built in Bolt (Mar 4, 2025)
- Hacker News comment by dominickgurnari on a workout summary site built and deployed in under an hour (Aug 4, 2025)
- Hacker News comment by muzani on Bolt for UI ideas and token use (Jun 13, 2025)
- Hacker News comment by pc86 on apps collapsing after the second or third feature (Jun 19, 2025)
- Hacker News comment by tezza on fix loops in Bolt (Jul 9, 2025)
- Hacker News comment by janpot on reverting broken changes over fixing them (Jul 9, 2025)
- Hacker News comment by exiguus on product owners prototyping epics (Jul 9, 2025)
- Hacker News comment by saxenaabhi on a restaurant POS rewritten with Bolt (Oct 14, 2025)
- Hacker News comment by therealcapi on tokens spent and payments broken at launch (Dec 19, 2025)
- Hacker News comment by mexicocitinluez on an agency CEO sketching UI in Bolt (Jan 17, 2026)
- Reddit post by AffectionateShine404 in r/boltnewbuilders on a client's Zillow data tool built with Bolt Database Edge Functions and Stripe (Jan 28, 2026)
- Reddit post by PeanutButterSoln in r/boltnewbuilders on regressions in a 15,000-line Bolt app (Jul 21, 2026)
- Reddit post by No_Birthday8126 in r/boltnewbuilders on Bolt losing track of a growing project (Jun 21, 2026)
- Reddit post by HandSharp1093 in r/boltnewbuilders on Bolt rewriting code files without warning (May 23, 2026)
- Reddit post by Conscious-Item-837 in r/boltnewbuilders on saved tokens expiring after two months (Aug 7, 2026)
- Reddit post by Ilikethishandle in r/boltnewbuilders on moving a Bolt site's repository to Google Antigravity (Jan 21, 2026)
- Valtech EU Design: What Bolt vs. Lovable taught our design team (Jun 26, 2025)
- Bill Prin, AI Engineering Report: From zero to a monetized iOS app in 10 hours with Bolt.new (Jun 25, 2025)
- Addy Osmani: AI-Driven Prototyping, v0, Bolt, and Lovable Compared (Jan 11, 2025)
- securityscanner.dev: Lovable vs Bolt vs Replit, who is leaking the most Supabase data (Apr 16, 2026)
- Roland Shen on X: bringing Ramp's component library to Bolt (Mar 24, 2025)
- Roger Wong: Beyond the Prompt, eight AI design tools scored on one checkout prompt (Apr 28, 2025)
- Bolt blog: Bolt.new comes to Microsoft Azure and Microsoft 365 (May 5, 2026)
- Bolt Help Center: Tokens
- Bolt Help Center: Check your project's security
- Bolt Help Center: GitHub for version control
- Bolt Help Center: Account settings (Model training)
- StackBlitz Privacy Policy (last updated Sep 22, 2026)