Is bolt.new vibe coded?

Reading this score

bolt.new landed on 15/100, which puts it in the hand-written band. That number is not a percentage and not a probability — it is strength of evidence: 32 points of tells, damped by craft, less 32 points of deliberate decisions, mapped through one logistic curve.

What pushed it up

• Bolt / StackBlitz fingerprints +18 — Bolt or StackBlitz artifacts are shipping with the page.
• The typeface nobody chose +9 — None of these are bad faces. The tell is that they arrive as the default — the page reads as though nobody made a typography decision.
• Exactly three feature cards in a row +8 — Features arrive in threes, as tradition demands — regardless of how many things the product actually does.
• Everything centred +7 — 18 centred blocks. Long centred text is measurably harder to read, and with no left-aligned anchor the hierarchy flattens.
• Spacing that doesn't keep time +5 — 6 different vertical rhythms across 7 sections, because each one was generated in its own prompt. The page reads as unfinished even to people who can't say why.
• A bento grid because bento grids exist +5 — Asymmetric tiles used as a style rather than because some tiles matter more. If shuffling them changes nothing, the grid is decoration.

What pulled it down

• Deliberate social preview −9 — Open Graph title and image were both authored.
• Hand-written ARIA −7 — 14 explicit accessibility attributes.
• Structured data −6 — JSON-LD is present — somebody thought about search.
• Semantic landmarks −6 — 4 landmark elements instead of a pile of divs.
• Canonical URL −4 — Canonical link is set.

Craft we looked for and did not find

These are the actionable half of the report. None of them are hard, and every one of them would have moved the number.

• Skip-to-content link
• prefers-reduced-motion honoured
• Self-hosted typography
• CSS custom property system
• Hand-authored stylesheet
• No utility-class soup

What this scan cannot see

One request, no JavaScript executed. So everything below is invisible to us, and a page can be excellent or awful at all of it without moving the score:

• Domain registration age — needs WHOIS.
• Whether the nav's /about and /pricing actually resolve — needs a crawl, not one fetch.
• package.json dependency count, orphaned code, clashing abstractions, test coverage — needs the repo.
• Backend security shortcuts: string-built SQL, verify=False, missing auth on endpoints — needs the source.
• Whether row-level security or Firebase rules are actually switched on — needs the project.
• Console errors, hydration warnings and runtime 404s — needs a browser executing the page.
• Real Lighthouse numbers and horizontal scroll at 375px — needs a rendered viewport.
• Whether a JS-handled form posts anywhere — needs a submitted request.