You described it, watched Bolt assemble the whole thing in the browser, and it works. Going from that to something strangers can sign in to is a different job: it is about who can reach the data, where the keys are kept, and what you do on the day something breaks.
These come up again and again — not because the tool is bad, but because they are invisible until someone goes looking.
Anything the browser needs, the browser can be asked for — and an API key pasted into the frontend during a build session is readable by anyone who opens developer tools. Roughly one in nine scanned indie apps exposes database keys this way.
Secrets are encrypted per app and per environment and injected at runtime. They never enter the code, never reach the bundle, and never get pasted into a chat.
A screen can look private and still answer anyone who requests the data behind it. Sign-in that was scaffolded quickly tends to protect the interface rather than the records, which is why 45% of AI-generated code carries an OWASP Top-10 vulnerability.
A hosted sign-in page, your own user list, roles that decide who sees what, and multi-factor authentication — managed rather than hand-rolled, so the check happens on the server every time.
An export you took once is not a backup, and a backup nobody has restored is a guess. The first time most people test recovery is the day they need it.
Backups run on a schedule around the clock, are verified by actually restoring them, and are stored encrypted. Recovery is a single action.
Each change is another chance to publish a credential or a broken permission, and the deploy that does it looks exactly like the one before.
Automatic secret scanning runs on every deploy and blocks a release that would expose credentials — on every plan. Continuous automated penetration testing ships to Pro when it lands.
You keep prototyping in Bolt. Softkiln is where the result runs once other people depend on it.
Your app and its backups run in the EU by default, on your own domain with the certificate renewed for you, watched around the clock with a public status page.
No. Bolt is where the app gets built; Softkiln is where it runs for real. Nothing about how you make changes has to change.
A link makes an app reachable. It does not give you managed sign-in with roles, keys held outside the code, backups that have been restored and checked, or a scan that blocks a release leaking credentials. Those are what the link does not cover.
Nothing for 15 days, and no card to start. After that it is $15 a month per app, or $49 once real people depend on it.
Figures from the research linked on the home page. More questions in the FAQ.