Bolt.new rescue

Bolt shipped it in the browser. We fix what breaks outside it.

Bolt.new runs your entire app inside a browser tab, filesystem, server, package manager, all of it, which is a genuinely clever way to go from prompt to running app with zero local setup. The failures we see start at the edges of that trick: packages that need a native binary WebContainer can't load, a deploy to Netlify that quietly drops your environment variables, or a bug-fixing loop that burns through tokens without actually fixing anything. We find where the in-browser version and the real-world deployment stopped matching, and we close the gap.

Send us the repo Read the FAQ

Founder

“`sharp`, `bcrypt`, or `better-sqlite3` fails to install and nobody knows why.”

Auditor

“The build worked in Bolt. Netlify shows 'Site Not Found.'”

Engineer

“A fix attempt burned real money and the bug is still there.”

Investor

“One small edit request rewrote the entire page.”

Co-founder

“The app has real secrets sitting in client-side JavaScript.”

Hire

“'Project Too Large' errors started showing up out of nowhere.”

If you see this, this is you

The signals.
What they actually mean.

“`sharp`, `bcrypt`, or `better-sqlite3` fails to install and nobody knows why.”

WebContainer can't load native addons. It's not a bug, it's the platform — StackBlitz's own repo documents the exact error: 'Cannot load native addon because loading addons is disabled.' Any package needing a compiled binary is off the table inside Bolt.

“The build worked in Bolt. Netlify shows 'Site Not Found.'”

Environment variables set in Bolt's Secrets panel don't automatically carry over to Netlify. The app crashes on an undefined variable with an error that doesn't say why.

“A fix attempt burned real money and the bug is still there.”

One Trustpilot review, dated December 2025: 'over 15 million credits' to connect a Gmail and a calendar booking. Another, from November: 'it can do nothing but go in a loop of trying to fix things until all your tokens are consumed.'

“One small edit request rewrote the entire page.”

Common enough that StackBlitz shipped a dedicated 'Diffs' feature specifically to stop Bolt rewriting whole files on small changes — an opt-in fix for a problem real enough to need one.

“The app has real secrets sitting in client-side JavaScript.”

Bolt is frontend-first by default, so OpenAI keys, Stripe secret keys, and Supabase service-role keys end up in the bundle DevTools can read. Automated key-scanners find these within minutes of a public deploy.

“'Project Too Large' errors started showing up out of nowhere.”

Bolt's own support docs describe this directly: past a certain context size, 'you might see errors, slower responses, or lower-quality results.' It's a stated platform ceiling, not a fluke.

Our process

Five steps. 14 days.

012 days

Audit

We clone the repo, list every dependency that needs a native binary, and check what's actually reaching the client bundle versus what should be server-only. We also pull your Netlify env vars and compare them against what Bolt's Secrets panel thinks it deployed.

021 day

Triage

Keep, rewrite, delete. For Bolt apps it usually lands around 60/30/10 — the frontend is often fine, the deployment and secrets layer usually isn't.

035–8 days

Foundation

Native-dependent packages get replaced or moved to a runtime that can actually run them. Secrets move server-side. Environment variables get set directly in Netlify, or wherever we're deploying to, not assumed to have transferred.

042–3 days

Migration

We stand up the corrected deployment in parallel with the old one, verify it against production traffic patterns, then cut over.

051 day

Handoff

Documented, deployed, CI green. Bolt still works fine for iterating on UI afterward — the parts it can't run natively just aren't load-bearing anymore.

What we do with the code

Three piles. Honest splits.

Keep

60%

Frontend UI, component structure, anything that doesn't need a native binary or touch a secret directly.

Rewrite

30%

Deployment config, environment variable handling, anything relying on a package WebContainer can't run.

Delete

10%

Duplicate fix-loop attempts left in the codebase, dead functions from a rewrite that didn't get cleaned up.

Verdict

Who this is for.

StackBlitz's own words, from the October 2025 Bolt v2 launch announcement, describing the tool's first generation: "endless error loops, infrastructure headaches, and projects collapsing under their own weight." That's not a competitor's review. That's the company describing its own earlier product. Bolt is genuinely fast for what it's built for: a prompt-to-running-prototype in a browser tab, no setup, good enough to demo or validate an idea same-day. The trouble starts once that prototype needs to run outside the browser tab that built it — native packages, real secrets, an actual production deploy. That's a different problem than the one Bolt was solving, and it shows. If your Bolt app is still a prototype nobody's paying for, you might not need us yet, get it deployed properly first and see what breaks. If it's live, has users, and something in the list above matches what you're seeing, send us the repo.

FAQ

Questions founders ask.

Why does my app work in Bolt but fail on Netlify?

Usually environment variables. Bolt's Secrets panel doesn't automatically push everything to Netlify's own settings — we check this first, it's the most common single cause.

Can you fix a package that WebContainer won't install?

Yes, but the fix is usually moving that dependency off WebContainer entirely, onto a real server runtime, rather than finding a workaround inside Bolt.

How do I know if my app has exposed secrets?

We check the client bundle directly for anything that looks like an API key or DB credential. If DevTools can see it, so can anyone else.

I've already burned a lot of tokens on failed fix attempts. Does that matter?

Not for the audit — we look at the current state of the repo, not how much it cost to get there. It matters for your budget going forward, which is part of why we quote a flat price instead of hourly.