Explain My BuildHow to document your Bolt.new app
Last updated: July 26, 2026
To document a Bolt.new app, connect its GitHub repo or export to Explain My Build. It reads the real code Bolt generated — typically a React/Vite front end with a Supabase back end — and writes an end-user guide, a founder runbook and a code-verified fix-list, each claim cited to a real file.
Which "Bolt" is this? (Bolt.new, not the others)
This page is about Bolt.new, the in-browser AI app builder made by StackBlitz. It is not Bolt the ride-hailing and delivery company, and not Bolt the one-click checkout/payments company. If you prompted an AI in your browser and it built and previewed a web app live, you're in the right place.
Bolt.new stands out because it runs a full Node.js environment inside your browser tab using StackBlitz's WebContainer technology — compilation, bundling and preview all happen client-side, with no remote build server. That's a Bolt-specific detail worth knowing when you document it.
What does Bolt.new build, and what does it export?
A Bolt.new app is standard web code the AI wrote in the browser, which you can then export and deploy. Typical Bolt-specific facts:
- Front end: commonly React with Vite (Bolt's WebContainer also runs Next.js and plain Node projects). Modern, readable code — not a proprietary format.
- Back end: Supabase is the default for data, auth and file storage, wired in with the Supabase JavaScript client.
- The key security detail: Bolt apps use a Supabase anon key that is intentionally public in the client-side code, with security relying on Row-Level Security policies. If those policies are missing, your data can be exposed even though "nothing looks wrong."
- Deploy: Bolt deploys straight to Netlify (and integrates with Vercel and Cloudflare) as a static React app plus serverless functions.
Explain My Build reads whichever of these your project actually uses, from the exported repo or a local folder — it doesn't assume, it reads.
Before and after: a raw Bolt project becomes a user guide
Here's what reading the code does for a Bolt.new project:
| Raw Bolt.new project (what you have) | End-user guide excerpt (what your users get) |
|---|---|
A React app with a Supabase orders table, an anon key in supabaseClient.ts, and a Netlify serverless function that emails a receipt. | "Placing an order: Add items to your cart and select Checkout. Once payment succeeds you'll get a confirmation email with your receipt. Your order history is private to your account." |
The guide reads the checkout route, the receipt function and the data model directly. It can also see whether that orders table has a row-level security policy — something a screen recording can never observe.
What will your Bolt users ask, and what do you get?
Your Bolt app's end-user guide should answer the real questions users type, derived from your code:
- How do I sign up and log in? (from your Supabase auth)
- How do I complete the core action — order, book, submit, generate? (from your main route)
- Where do I see my history or past items? (from your data queries)
- Is my data private to me? (from your row-level security policies)
- How do I get a receipt / confirmation? (from your serverless functions)
From one code read you get three artifacts:
- End-user guide with share link, access code, in-app Help widget and portable export — $19/month ($12/month founding for the first 100).
- Founder runbook — how to run and extend your Bolt app, including the Netlify/Supabase setup. Free.
- Code-verified fix-list — ranked, cited issues to hand to your AI. For Bolt apps this frequently surfaces a Supabase table with Row-Level Security left off. Free.
Reading code is not a live security test
Explain My Build can see, from the code, whether your Supabase policies exist and whether keys are exposed — that's genuinely useful for Bolt apps that lean on RLS. But it is not a live penetration test, and it can't inspect settings that live only in your Supabase or Netlify dashboards. It flags what it can't verify. See is my Bolt app secure? for what the check covers.
Frequently asked questions
How do I write a user guide for my Bolt.new app?
Export your Bolt.new project to GitHub (or download it) and point Explain My Build at the repo or run it as a local folder in your browser. It reads the React and Supabase code Bolt generated and writes a plain-English end-user guide cited to your real routes and features. You review it before publishing.
Is this the same Bolt as the ride-hailing or checkout company?
No. This is Bolt.new, the in-browser AI app builder by StackBlitz that builds and previews web apps using WebContainer technology. It's unrelated to Bolt mobility or Bolt one-click checkout.
Bolt uses a public Supabase key — is my data exposed?
The anon key being public is by design; safety depends on your Row-Level Security policies. Explain My Build reads your code to check whether those policies exist and flags tables that lack them, so you can fix the gap. For a fuller read, see is my Bolt app secure?
Do I need to deploy my Bolt app before documenting it?
No. Explain My Build documents from the code, not the live site, so you can document a Bolt app whether or not it's deployed to Netlify yet.
Turn your app into a guide your users can follow.
Paste a public GitHub link and get your founder runbook + fix-list free in about a minute — no sign-up. Private code runs entirely in your browser.