What the tools do for you — and what is still yours
| Area | What Bolt.new and v0 now offer | What is still yours to decide |
|---|---|---|
| Hosting | Publish to real hosting from inside the tool | Who pays, who has the keys, what happens if you leave the tool |
| Security | Bolt: a project security audit on paid plans that fixes most problems and lists the rest | Whether the result fits your data, your users and your regulator |
| Who can read which data | Generated rules that work for the screens you asked for | The rules your business actually needs — staff, customers, partners |
| Payments | A checkout that works in the happy path | Refunds, failed payments, disputes, records that agree with the money |
| Other systems | Connections you prompted for | Owners, limits, sign-in and failure handling for each one |
| Tests and monitoring | Little by default | Enough tests that fixes stay fixed; alerts before customers notice |
| Compliance | Not in scope | Health or EU personal data handled as an auditor will expect |
What their own documentation says
Bolt.new. Bolt’s help centre recommends a security check before publishing. Its project security audit, available on paid plans, reviews code and database, “fixes most problems on its own”, and notes that “sometimes you may need to make a change yourself, like updating a setting in a service you’ve connected to your project” (Bolt Help Center, Check your project’s security).
v0. Vercel’s FAQ says “the code generated is ready to deploy on Vercel’s globally scalable infrastructure”, that Vercel “doesn’t own the code generated”, and that output “may be the same or similar to other users’ output or third party’s IP, be incomplete or contain bugs” (v0 FAQs).
Both checked 5 October 2026. Both are reasonable positions for a tool. They also draw the line clearly: the tool checks the code; deciding whether the app is right for your business stays with you.
Ready to deploy is not ready for customers
A deployed app answers “does it run?”. Production asks different questions: what happens when two people edit the same record, when a card is declined halfway through, when the email provider is down, when a customer asks for their data to be deleted. None of those is a bug a security audit will find, because none of them is in the code until someone decides the answer.
Before you launch
- Move the code into a repository you control.
- Write down who may see and change which data — then check the app does exactly that.
- List what happens when things fail: payments, email, other systems.
- Decide how you will know it is down before a customer tells you.
- Check whether health data, payments or EU residents’ personal data are involved.
How Pricient handles a Bolt or v0 app
Your prototype is the requirements document — its screens, flows and decisions are already there. Describe what you built; today a person runs the intake with you by email. Before you pay anything you receive the specification, wireframes of every screen, the Not in this release list, the assumptions register and a three-tier itemized quote, QA and security in every tier, locked for 14 days.
The launch-ready MVP starts from $7,500, fixed once your spec is agreed: live 3 weeks after the spec is agreed, security-hardened, 80% test coverage and three months of support. Code you share is read-only, logged, never used for training, and deleted within 30 days of the evaluation ending unless we engage.