Bolt is fast. Describe what you want and you're looking at a working app — often backed by Supabase — in minutes. For validating an idea or building a v1 in front of a client, that speed is genuinely hard to beat.
What Bolt doesn't do is lock down the Supabase project it just created for you. The defaults are built for you to keep building, not for a stranger to be poking at your database by lunchtime.
The Bolt-specific issues we see most
Supabase RLS policies left disabled or fully permissive — the single most common Bolt issue by a distance
VITE_-prefixed environment variables shipping straight to the browser bundle
Auth state held in React context with no corresponding server-side verification
No migration history — schema changed by hand in the Supabase dashboard, so nothing is reproducible
Edge functions with no error handling or timeout
Storage buckets left public
No environment separation — one database serving dev and production
A checklist you can run yourself
Give this a real go before reaching out — the people who can fix it themselves were never going to hire us, and the ones who read it and realise the scale of the job usually do.
Open your Supabase dashboard → Authentication → Policies. Confirm Row Level Security is enabled on every table, not just the ones you remember creating.
Check whether any policy reads USING (true) — that's "anyone can read everything," not a real rule.
Search your codebase for VITE_-prefixed variables. Anything with that prefix is already in the browser bundle, visible to anyone.
Open devtools → Network on a request to Supabase and confirm you're not sending a service-role key from the client.
Try loading a protected page directly by URL while logged out. If it flashes before redirecting, the check is client-side only.
Check Storage → Buckets in Supabase and confirm nothing is public that shouldn't be.
Confirm you have separate Supabase projects (or at least separate schemas) for development and production.
Look for a supabase/migrations folder. If it's empty or missing, your schema only exists in the dashboard right now.
Trigger an error deliberately and confirm the app shows something other than a blank screen.
When to get help
Worth getting a second pair of eyes on this once real users are on it, payments are involved, you're handling anyone's personal data, or someone other than you will need to maintain this going forward. Below that bar, the checklist above will get you most of the way.
Read the full AI app rescue guide, or see the checklist for Lovable, v0, Cursor or Replit.