Bolt MVP hardening: make acquisition a controlled experiment

Lock down the primary funnel, server-side authorization, rate and spend limits, validation for every write, upload and payload caps, secret separation, backups with a restore drill, error boundaries, and a rollbackable deploy. Confirm cancellation, deletion, consent, and billing behavior where applicable. We do not call a second feature “minimum” until the first customer journey survives abuse, retries, and an unavailable dependency.

Check that a client cannot substitute another user’s ID, that session expiry has a clear recovery path, and that logout invalidates the right material. Audit browser bundles and logs for provider keys, redact credentials in error reporting, and rotate anything exposed during prototyping. Exercise email verification, OAuth denial, password reset, multi-tab use, and a revoked session against the deployed build.

Track acquisition through activation with an event vocabulary that matches the product question, then connect it to request IDs, status codes, latency, queue age, provider failures, and client crashes. Alert on the few symptoms that threaten a campaign or customer—not every noisy warning. A launch owner should be able to locate one user’s failed action, explain it, and recover it from the recorded evidence.

For web, insecure headers, broken consent, inaccessible critical controls, missing transactional email alignment, and a payment flow that fails on refresh can stop the campaign. For iOS or Android wrappers, privacy manifests, account deletion, permission copy, deep links, test credentials, signing, and upgrade behavior can stop review. We run clean-install and degraded-network checks before buying traffic or submitting the binary.