How to build a startup directory website with Bolt

Rule of thumb: if you want a directory this week and do not care whose software it runs on, rent one. Brilliant Directories or eDirectory will have you live before this guide is finished. If the directory is the product, or the thing that brings people to your newsletter, your fund or your community, the shelf is worth owning, because the meters above are exactly where a growing directory pays and a curated list of companies with their rounds is an asset you should be able to move, export and redesign at will. The honest middle case is a directory whose value is somebody else’s data. There the answer is a subscription, because you may read Dealroom’s rounds and you may not republish them.

* On this template the free-tier lines to watch are images and the pause. The free plan includes 1 GB of file storage, and a cover or gallery image may be up to 10 MB, so a directory with a few hundred companies and their pictures reaches it. It also pauses a project after a week without activity, and a directory nobody edits for a week is normal. Pro, from $25/mo, lifts storage to 100 GB, ends the pause and keeps a daily backup for 7 days, with spend caps on by default.

Prices and rates from supabase.com, developex.com and bolt.new, checked September 2026.

The GitHub step comes before Bolt exists for you at all. Everything after it happens inside the browser tab Bolt opens, with no install.

1. 01

   Create the project online, import it, then connect the database and design the tables

   Bolt has no upload button, so the project has to exist as an online repository first. The directory cannot show anything without a database, so the tables and the publish rule come next.

   PromptSet up, connect the database, design the tablesCopy

   This project is a startup directory with news and a funding tracker. Set it up as React 18 + Vite + TypeScript with Tailwind, and keep this vocabulary throughout: startups, funding rounds, categories, tags, articles, admins. Two standing rules for the whole build: nothing is public until its status is published and the database enforces that rather than the screen, and only an admin may add, change or delete anything. Now connect a database and build the tables. Categories and tags with a name and slug. Startups with name, slug, short and long descriptions, a category, a funding stage from a fixed list (Seed, Series A through Series E+, IPO, Grant, Acquisition), a published or unpublished status defaulting to unpublished, an archived flag, logo and cover addresses, a gallery, team size, city and country, links, and total and latest funding columns. A startup_tags join table and a social links table. Funding rounds with stage, amount, date, lead investor, co-investors, valuations and notes, and a trigger that recalculates the startup’s total and latest raise on every change. Articles with title, slug, body, featured image, category, author, status and published date, and a news_tags join table. Turn on row-level security with the public half of the rules: anyone may read categories and tags, a published and unarchived startup with its rounds and links, and a published article. Seed three companies with a round each, one unpublished.

   Keep the repository private. Bolt commits to it automatically as you build, and the environment file naming your database will be in it.

2. 02

   Clear the context, then get the directory filtering in the preview

   Cards, filters, a sort menu, a count, a view per company and the funding page, reading real rows. The preview is the running site, so the draft company should already be missing.

   PromptBuild the directory and the funding pageCopy

   Build the public directory page: a grid of company cards with the logo, name, one-line description, category, stage and total raised, a filter sidebar with search over name and description, categories, funding stages, a minimum and maximum amount raised and a location field, a sort menu (newest, oldest, most funded, least funded, A to Z) and a live result count with a clear-all button. A card opens a detail view with the full description, links and the rounds in date order, at an address of its own so a link can be shared. Then build the funding page: every round with its company, stage, amount, date and investors, filterable by stage and by amount, sorted by amount. Read only published, unarchived companies on both.

   Count the cards in the preview. Two means the rule from step 01 holds. Three means it lives in the screen, and that is the thing to fix before anything else is built on it.

3. 03

   Point one prompt at the database layer: sign-in, roles and the admin gate

   Name the layer rather than letting the prompt range over the whole project. Two roles and one clean line between the public and the admins.

   PromptAdd auth, roles and the admin rulesCopy

   Working on auth and the database layer only. Add email-and-password sign-in with logout and a persisted session, and no public sign-up screen. Add a user_roles table with admin and viewer roles, a security-definer has_role function, and a trigger that gives every new account a profile row and the viewer role. Write the admin half of every access rule so an admin may read, add, change and delete every row in every table, drafts included. Build an admin layout that sends anyone without the admin role back to sign-in. Tell me how to promote my own account, and show me that a viewer sees exactly what a signed-out visitor sees.

   Naming the layer keeps the prompt narrow, which Bolt charges you less for and which makes the result easier to check.

4. 04

   Talk the admin through in Plan Mode before it is written

   This is the largest and most expensive-to-redo screen set in the build. Agreeing the screens, the delete behaviour and the upload check before Bolt writes a line is exactly what Plan Mode is for.

   PromptBuild the admin and the image storageCopy

   Use Plan Mode for this one. I need the admin behind the admin layout: a dashboard with counts of startups, articles and accounts, a startups screen with add and edit dialogs, add a funding round, publish or unpublish, archive, and delete a company together with its rounds, links and tags, then screens for articles, categories, tags, and users where a role is switched between admin and viewer. Four storage buckets (logos up to 5 MB, covers, gallery and article images up to 10 MB, image types only), readable by anyone and writable only by admins. A server-side function on the database side for logo uploads that checks the caller is a signed-in admin, checks the startup exists and the file is under 5 MB, then stores the image and writes its address to the startup, with other images uploading directly under the bucket rules. Talk me through the screens and what a delete removes first, then build it.

   The upload function runs on the database side rather than in Bolt’s preview, which is where the service key has to live anyway. If Bolt asks for that key when it scans the code, leave it blank.

5. 05

   Clear the context, then add the news section

   Articles with a page each on the public side, filled from the articles screen you already have. A separate feature, so a clean slate.

   PromptBuild the news sectionCopy

   Build the news section: a list of published articles with the featured image, title, category and date, and a page per article at /news/its-slug showing the featured image and the body with its line breaks kept, reading only published rows. Write a draft article in the admin, confirm it is invisible on the news page, publish it, and confirm it appears.

6. 06
   Destination

   Add the landing page and the meta, then ship it

   The marketing page and the share cards come last. Click the whole thing through as a stranger, then publish, to Bolt’s own hosting by default, or to Netlify if you would rather keep the domain there.

   PromptAdd the landing page, demo mode, and publishCopy

   Add a marketing landing page with a hero, a sector section, a funding section, a trends section and a closing call to action, written as copy I can edit rather than pulled from the database. Give every public page a title and description and the card that shows when the link is shared. Add a demo mode switch on the sign-in screen that opens the admin with every write intercepted in the browser and a banner saying changes are not saved. Then walk me through the full site in the preview signed out: confirm the unpublished company is nowhere, confirm an article address opens directly, confirm the admin sends me to sign-in, and once it holds up, publish it.

Review the access rules (row-level security policies) on every table. For each one, tell me in simple terms who can view, add, edit, and delete records, confirm that people can only reach their own data while the right roles can reach more, and flag anything left open that shouldn’t be.

One rule outranks everything above it: your database service key belongs on the server only, never in the app a visitor downloads and never in a repository. The publishable key is meant to be public and the access rules are what protect the data behind it, so if the service key escapes, treat it as compromised and replace it the same day.

Two things decide this, and speed is not one of them. Does the plan allow commercial use, since a directory that runs ads, sells listings or belongs to a fund is a business and Vercel’s Hobby tier is not for one. And does a link to a single article open that article for someone arriving cold, because every host here needs one routing rule for that and the template ships the Vercel version. The host serves one small static folder. Every listing comes from your database.

Add a server-side function called ai that calls my AI provider with the key held in function secrets, never in the browser. It accepts a task name and the text or fields for that task, refuses any caller who is not a signed-in admin, records every call in an ai_calls table (who, which task, tokens in and out, a cost estimate, success or failure), and returns the model’s answer as structured fields the admin screens can fill in. Add a small usage panel to the admin dashboard showing calls and estimated spend this month.

In the add-startup dialog, add a “Draft from website” button that sends the company’s homepage text to the ai function and gets back a one-line and a paragraph description, a suggested category from my categories table, up to five tags, the city and country, and any social links it found. Fill the form with the results for the admin to edit, and never publish anything automatically.

Add a “From announcement” action on the news screen that sends pasted text to the ai function and gets back a draft article (title, slug, body) and, if the text describes a raise, a funding round (stage from my stage list, amount, date, lead investor, co-investors). Show both as prefilled forms for the admin to confirm, match the article to a startup by name with a confirmation step, and leave both unpublished until the admin publishes them.

When an admin saves a startup or an article without tags, call the ai function with the description and get back a suggested category from my table and up to five tags, preferring tags that already exist. Show them as chips the admin accepts or removes before saving, and add a “Suggest tags” button on existing records so the back catalogue can be tidied a page at a time.

Add a “Weekly digest” button on the admin dashboard that gathers the startups, rounds and articles published in the last seven days and asks the ai function for a short digest with a headline, one paragraph, and a bullet per raise with the amount and stage. Save it as an unpublished article and offer a copy-as-text button, since this site does not send email.

Pick a lighter model for the high-volume prompts above and save a stronger one for wherever the reasoning actually matters. That is the same token-budget logic as the rest of this page, applied to the app’s own AI calls instead of the build itself. When Bolt flags a missing secret, add the key through its secrets settings instead of pasting it into the chat, and keep every AI feature behind one server-side function so there’s only one key to manage.