Bolt gets it working. Grace is what happens for the two years after.
Bolt turns a conversation into a running app with hosting, a database and integrations behind it, and it says it automatically tests, refactors and iterates to reduce errors. What it does not publish is any security review, any code review, or anything that runs once you have stopped building.
What Bolt is for
- Going from an idea to something running in a browser, fast
- Enterprise-grade backend infrastructure you did not have to assemble: hosting, databases, integrations
- Automatic testing, refactoring and iteration while you build
- Importing an existing project from GitHub or a design from Figma
- Hosting with analytics and custom domains once it is out
None of this is a criticism. Bolt does it well, and Grace doesn't do it at all.
What Grace is for
- Auditing what the prototype actually became, including the parts added by hand afterwards
- Putting tests on the flows that would cost you money if they broke, before touching anything
- Watching every push and pull request from then on
- Fixes arriving as pull requests, tested, explained and reversible
- A record of why each decision was taken, kept next to the code
And it does check itself as it goes
Read off their own documentation in August 2026.
Bolt states that it automatically tests, refactors and iterates, which reduces errors. That is a build-time loop, and it is genuinely useful: a lot of what would otherwise reach you as a broken page never does.
- Testing and refactoring happen while the app is being generated, as part of the loop that produces it.
- Analytics come with the hosting, so you can see traffic arriving.
- As of August 2026 Bolt publishes no security review, no code review on changes, and no post-launch code monitoring. We looked for it rather than assuming its absence.
The gap is the whole second phase
Every one of Bolt's checks happens while you are building. None of them is watching six months later, when the app has users, a payment path and three features nobody documented.
- Tests written during generation prove the app does what was asked. They say nothing about whether an endpoint checks who is calling it.
- Analytics tell you a page is being visited. They do not tell you that page reads every row in the table because a loop makes one query per result.
- Nothing re-reads the code after you stop prompting. The risk in an AI-built app is not created on day one, it accumulates.
- A prototype that survived contact with users becomes production software without anyone deciding it had. That is the moment this page exists for.
Where the two stop overlapping.
| Bolt | With Grace | |
|---|---|---|
| Writes the first version | Yes, that is the product | No |
| Checks while building | Automatic tests, refactors, iterations | Not its job |
| Security review | None published as of August 2026 | Auth paths, secrets, dependencies, access control |
| After you stop building | Hosting and analytics | Every push and PR analysed, continuously |
| Works on code added by hand | Import from GitHub supported | Reads whatever is in the repository |
| How a fix arrives | You prompt for it | A tested pull request you approve or decline |
Checked against Bolt's own documentation in August 2026. These products ship monthly. If something here is out of date, tell us and we will correct it.
Using both is the normal case.
Prototype in Bolt because that is the fastest way to find out whether the thing should exist. Then, on the day it stops being a prototype and starts being how someone gets paid, hand the repository to Grace. Nothing gets rebuilt and nothing gets migrated: Grace works on the repo Bolt produced, as it is.
The five deliverables, in order →
What we keep finding in Bolt repos
When you don't need Grace.
The audit is free, so the worst case is an hour and a report. But there are situations where the answer is simply no, and we would rather say so here than after you have paid.
- The prototype is still a prototype and has no users. Come back when it does.
- You intend to throw this code away and rebuild properly. Grace would be paying to maintain something with a known expiry date.
- You already have a team doing code review and watching production.
What people ask about the two.
It is the same verb doing a different job. Bolt's loop checks that what it just generated works, while it is generating it. Grace checks what the whole application has become, months later, against what would actually hurt if it broke. Neither replaces the other, and only one of them is still running in November.
No. Grace reads the repository and opens pull requests on it. You can keep building in Bolt, keep hosting where you host, and keep prompting for features. Nothing about the way you work changes except that a second reader is now looking at every change.
That is the normal shape of these repositories and it is exactly what Grace was built to read. It starts from the code, not from the tool that produced it, and the parts nobody can explain are usually the interesting parts.
Point Grace at the repo Bolt produced.
The audit is free and nothing gets rebuilt. In minutes you'll know what will break first.