Skip to main content

Decision brief

Bolt Review: Where StackBlitz's AI App Builder Fits for Prototypes and Small Apps

Pilot Bolt for prototypes and small JavaScript apps built outside engineering, with a token budget per seat, private publishing, and an engineer named to take over the code.

Reading time
4 min read
Sources
29 cited
In this piece
Bolt+60 Strong positive

GILD verdict

Pilot Bolt on a Teams workspace when product and design staff or founders need a running prototype or small JavaScript app.

Bolt puts the code editor, database, hosting, and GitHub sync in one browser tab. Before the first build, give each member a token budget, keep publishing private, decide every account's model training setting, and name the engineer who takes the code once an app matters.

Bolt

AI App Builder by StackBlitz

+60 Strong positive
Product page

Fit and limits

Who it fits

  • Product and design staff need a working prototype that stakeholders can click through, or a marketing site or small tool, before engineering commits time.
  • The app should run on a JavaScript framework of your choosing with a Node.js backend, or as an Expo app for iOS and Android.
  • Builders want code they can open. Editing files by hand in Bolt's code editor costs no tokens, file locking and targeting keep the agent away from parts of the app, and GitHub sync commits every working change.
  • One vendor should cover building, the database, and hosting. Bolt Cloud includes a database with sign-in, storage, and server functions, hosting on bolt.host with custom domains on paid plans, and Stripe payments.

Where it falls short

  • Tokens go mostly to reading and syncing project files, so each message costs more as an app grows. Bolt's own quickstart build used 204K tokens, and changing the app's title then took about 70K more. Teams tokens belong to each paid member and are not pooled.
  • Individual accounts outside the EU, UK, and Switzerland have model training and de-identified dataset licensing on by default for content from October 7, 2026, until each user opts out. Bolt Forge, kept since October 14, 2026 only by Lite subscribers, requires that data use as its condition.
  • Audit logs need Enterprise. Bolt's pricing table lists SSO on Teams too, while its help center limits SSO sign-in to Enterprise. Teams adds roles, integration controls, and usage exports.
  • Backends must be JavaScript. There is no public API or CLI, branches cannot be merged inside Bolt, and version history does not restore databases.

Implementation reality

  1. Choose the plan by who builds

    Pro is an individual plan, and Lite, a US$9 monthly plan for Bolt Forge's open-source models, closed to new sign-ups on October 14, 2026, and its subscribers keep it at US$9. Pro costs US$25 a month billed monthly, or US$18 a month billed yearly, for 10M tokens, and higher tiers include US$50 for 26M and US$100 for 55M. Teams costs US$30 per member a month, or US$27 billed yearly, and gives each paid member their own monthly tokens. It adds central billing, team knowledge, templates, private npm registries, and admin controls. Free members of a team can open projects but cannot prompt.

  2. Settle model training before anyone builds

    StackBlitz's privacy policy took effect for existing accounts on October 7, 2026. It lets Bolt train models on content created from that date, and license de-identified datasets built from it, unless the user turns off the Model training setting. The policy excludes accounts in the EU, UK, and Switzerland, accounts under a separate written agreement, and organization-managed accounts. Bolt's security page also excludes Enterprise and Team customers under an MSA or DPA. Have every personal-account builder turn the setting off before company content goes in. Bolt Forge, the open-model agent, uses prompts and code for training as a condition of use. Its research preview ran from September 14 to October 14, 2026, when Pro plans lost Forge. Only builders who subscribed to the US$9-a-month Lite plan by then keep it, so ask who is on Lite.

  3. Decide the database and stack in the first prompt

    New projects use Bolt Database by default. Pro and Teams can start on Supabase, connect an existing Supabase project, or claim a Bolt database into Supabase later, and there is no supported move from Supabase back to Bolt Database. A mobile app needs the words mobile app in the first prompt, because web projects do not easily switch to Expo.

  4. Keep sites private until they are ready

    Free sites are always public. Paid plans can publish privately to invited people and trusted email domains. Teams admins can force private or public publishing for every team project, choose Bolt Cloud or Netlify as the deploy provider, and block personal workspaces for team email addresses.

  5. Run the security audit before publishing

    Paid plans can run a security audit from the Publish menu that reviews code and database access, fixes most issues, and lists the rest, without spending tokens. Every plan can check database rules. An April 2026 scan by securityscanner.dev found critical data-access issues in 21 of 289 bolt.host apps, so an engineer still reviews any app that reads company data.

  6. Connect GitHub on day one

    Only the project owner can connect GitHub, so have the owner do it at the start. Sync then commits every change that does not break the project and pulls outside commits every 30 seconds, and a GitHub organization install lets admins choose which repositories Bolt can reach. Collaborators' changes sync the next time the owner opens the project. Fly.io's October 2026 production guide calls the generated code ordinary React, Next.js or Node. It treats the engineer's takeover as an audit of database ownership, secrets, and review.

What to measure in your pilot

  • GILD found token counts only for Bolt's demo build; log tokens per project each week, and hand an app to engineering once fixes take most of a week's tokens.
  • GILD found no count of how much Bolt code engineers keep. Have the receiving engineer log files kept and rewritten in the first month, and keep building in Bolt only if most survive.
  • Bolt publishes no count of accounts with Model training left on; export each member's setting before day one, check it monthly, and keep company content away from any account still opted in.

Sources

Official documentation
26
Public source
3
  1. Bolt pricingOfficial documentationbolt.new
  2. Bolt Help Center: BillingOfficial documentationsupport.bolt.new
  3. Bolt Help Center: TokensOfficial documentationsupport.bolt.new
  4. Bolt Help Center: Maximize token efficiencyOfficial documentationsupport.bolt.new
  5. Bolt Help Center: Choose an agentOfficial documentationsupport.bolt.new
  6. Bolt Help Center: Bolt ForgeOfficial documentationsupport.bolt.new
  7. Bolt Help Center: Teams plansOfficial documentationsupport.bolt.new
  8. Bolt Help Center: Teams plans, billing, tokens, and invoicesOfficial documentationsupport.bolt.new
  9. Bolt Help Center: Team settingsOfficial documentationsupport.bolt.new
  10. Bolt Help Center: Account settings (Model training)Official documentationsupport.bolt.new
  11. StackBlitz Privacy Policy (last updated Sep 22, 2026)Official documentationstackblitz.com
  12. Bolt: SecurityOfficial documentationbolt.new
  13. Bolt for EnterpriseOfficial documentationbolt.new
  14. Bolt Help Center: What is Bolt Cloud?Official documentationsupport.bolt.new
  15. Bolt Help Center: DatabaseOfficial documentationsupport.bolt.new
  16. Bolt Help Center: Supabase for databasesOfficial documentationsupport.bolt.new
  17. Bolt Help Center: Bolt Cloud hosting plansOfficial documentationsupport.bolt.new
  18. Bolt Help Center: Publish your project to a live websiteOfficial documentationsupport.bolt.new
  19. Bolt Help Center: Check your project's securityOfficial documentationsupport.bolt.new
  20. Bolt Help Center: GitHub for version controlOfficial documentationsupport.bolt.new
  21. Bolt Help Center: Set up GitHub organization accessOfficial documentationsupport.bolt.new
  22. Bolt Help Center: Expo for mobile appsOfficial documentationsupport.bolt.new
  23. Bolt Help Center: Supported technologiesOfficial documentationsupport.bolt.new
  24. Bolt Help Center: FAQsOfficial documentationsupport.bolt.new
  25. Bolt Help Center: Intro to BoltOfficial documentationsupport.bolt.new
  26. securityscanner.dev: Lovable vs Bolt vs Replit, who is leaking the most Supabase data (Apr 16, 2026)Public sourcesecurityscanner.dev
  27. AfterQuery: App-Bench, an AI web app builder benchmark (as of Oct 25, 2026)Public sourceappbench.ai
  28. Bolt Help Center: Bolt QuickStart guideOfficial documentationsupport.bolt.new
  29. Fly.io: Taking a Lovable, Bolt or Replit App to Production (Oct 12, 2026)Public sourcefly.io

Keep reading

  1. Buyer guideBolt Prototyping Playbook: From Prompt to an App Your Team Can TrustHow to set up a Bolt Teams workspace, keep builders out of fix loops, and check the audit, site visibility, and ownership before an app reaches colleagues or customers.
  2. Buyer guideBolt Tokens & Spend ChecklistWhich plan and token tier to buy, what spends tokens and what is free, how rollover and reloads work, and the hosting cap that keeps a live app from draining a balance.
  3. Buyer guideBolt Security & Data Handling ChecklistModel training defaults since October 7, 2026, Bolt Forge data sharing, database rules, site visibility, and team controls to check before company data goes into a Bolt app.
Read the research