VIBEHP GUIDE · UPDATED OCT 2026

Bolt app launch checklist

Bolt.new apps usually run perfectly in the WebContainer preview, then hit trouble on the first real deploy: missing env vars, dependency conflicts, or a database that anyone can read. Here's what to check before you share the link.

📊 We scanned 21 public vibe-coded apps: 57% had at least one Supabase policy open to everyone, 62% had committed a .env file, and 24% failed a clean npm install. The average launch health was 63/100.

01It builds outside Bolt

☐
Download or push the project to GitHub, then run npm ci && npm run build in a fresh folder. That's what Netlify/Vercel do.
☐
If install fails with ERESOLVE, fix the conflicting versions rather than relying on --force. A quarter of the apps we scanned failed here.
☐
The lockfile (package-lock.json) is committed, so your host installs the same versions you tested.
☐
The build output folder (dist) and build command match your host's settings.

02Environment variables

☐
Every variable your code reads (import.meta.env.*) is set in the host's dashboard. Missing ones are the #1 cause of a blank page after deploy.
☐
A .env.example documents each one. .env itself is ignored by git.
☐
Anything prefixed VITE_ is visible to every visitor. Only public keys go there.

03Database and secrets

☐
If you use Supabase: RLS is enabled on every table, and no policy uses using (true) on private data.
☐
No secret keys (OpenAI, Stripe secret, service_role) in the frontend. Move those calls into a serverless/edge function.
☐
Secret-scan the git history, and rotate anything that was ever committed.

04Launch polish

☐
Errors are handled: failed requests show a message, and an error boundary catches crashes.
☐
SPA routing works on refresh (add a _redirects or vercel.json rewrite to index.html).
☐
npm audit shows no critical vulnerabilities.
☐
Page title, favicon and social preview image are set (not "Vite + React").

Don't want to check all this by hand?

Paste your GitHub link. VibeHP runs every check on this page (plus a git-history secret scan and a real build) and gives you an HP score out of 100, with a copy-paste AI prompt for every fix.

Check my HP for $19 →

One-time · Your code is deleted right after the scan

FAQ

Why does my Bolt app work in preview but fail on Netlify?

Usually missing environment variables, a dependency conflict that only shows up on a clean npm install, or missing SPA redirects. Run npm ci && npm run build locally to reproduce it.

Is it safe to put my API key in a VITE_ variable?

Only if it's a public/publishable key. VITE_ variables are bundled into the JavaScript every visitor downloads.

Do I need Row Level Security with Bolt + Supabase?

Yes. Without RLS, anyone with your public anon key (which is in your frontend) can read and modify those tables.