Bolt and v0 produce the best-looking output in AI app building — polished frontends, coherent design systems, convincing flows. The production risk is the inverse of the polish: the backend mostly is not there, and the demo is engineered to hide it. Before real users, the job is an existence audit, then the universal checklist on whatever turns out to be real.
The existence audit
For every feature, answer one question: where does this actually live? Four states, in descending order of "real":
- Real — server-side logic, database persistence, validated inputs.
- Partial — an API route exists but validates nothing, or persists without ownership checks.
- Cosmetic — state in the browser, localStorage "persistence," client-side filtering of fully-fetched data.
- Mock — hardcoded data still wired into flows that look live.
The classic tells: refresh the page and see what survives; open a second browser and see whether "shared" data is actually shared; read the network tab during checkout and see what, if anything, the server was told.
The three cosmetic systems that must become real first
- Auth. A login screen storing a boolean in localStorage is a costume. Real sessions, server-verified, with ownership checks on every data access — the second-account test applies the moment auth claims to exist.
- Payments. Anything computing totals in the browser or flipping entitlements on redirect is demo machinery. Server-side amounts, webhook-confirmed entitlements, idempotent handlers — no exceptions for prototypes taking real cards.
- Persistence. If the database schema was never designed (because the prototype faked it), design it now — data models retrofitted under live traffic are the most expensive kind.
Keep the design, verify the rest
None of this is a reason to dismiss the tools: a v0 prototype is a genuinely valuable artifact — validated UX, a design system, a product spec in executable form. The failure mode is only ever promoting the prototype to production without the audit. Inventory, make the three systems real, run the universal checklist, then ship.
Want the inventory done with a verdict attached? The AI-Build Rescue Review maps real vs. cosmetic across your whole app in one working day for a fixed $1,450 — and ends with a harden-or-rebuild answer, plus the fixes ranked by what to make real first.
Frequently asked questions
Are Bolt and v0 apps production-ready?
As frontends, often surprisingly close. As applications, usually not — because the backend is frequently a sketch: state held in the browser, data 'persisted' to localStorage, API routes that exist but validate nothing, or mock data still wired into flows that look live. The production question for Bolt/v0 output is less 'is this code safe' and more 'which parts of this app actually exist'.
What is the biggest risk shipping a v0 or Bolt prototype?
Shipping the illusion of a backend. These tools optimize for a working-looking demo, so the seams are cosmetic: a checkout that renders beautifully but computes the total client-side, an auth screen storing a flag in localStorage, an admin page filtering data in the browser after fetching everything. Users and attackers both eventually find the difference between rendered and real.
Should I rebuild my Bolt app or harden it?
Inventory first: list every feature and mark whether its backend is real, partial, or mock. Prototypes with a real data layer and thin gaps harden well. Prototypes where auth, payments, and persistence are all cosmetic are usually faster to rebuild on the prototype's design — the design is the valuable output, and it is genuinely valuable. That inventory-then-verdict is exactly what a one-day review produces.
Written by Andrej Dragojevic, Stripe Certified Professional Billing Architect.