Blink.new test data

The Fitting Room brief was pasted word for word (1,689 characters) into Blink's home prompt, as a Full Stack App, at 16:38 UTC on 26 October 2026, and the clock started there. Every message I sent after that is in the ledger. The clock stops when the app is live and 20 of the 24 checks that need no keys of mine pass (the 30-check rule in proportion).

The first answer came after 12 minutes and 21 seconds and cost 15 credits. It built the member side only. It said staff access and Stripe were not connected, and asked whether to continue with Stripe and staff access. I picked the offered answer, staff access first.

Blink then said staff access needs a backend, which is a Pro plan feature, and recommended upgrading. I did not. My third message asked for the admin and instructor screens on Starter, with no separate backend. That took 8 minutes and 20 credits and it worked. I published at 17:09 and the app answered on its blinkpowered.com address at 17:10, 31 minutes after the brief. I added the 5 credits by hand and set up the accounts; 20 of 24 checks had passed by about 17:52, roughly 75 minutes after the brief, in 3 messages.

• The 5 credits per member and the account set-up were hand steps inside the 75 minutes.

The checks were run against the live app, by hand, with a note per check. The six that need your own Stripe and email keys (C24 to C29) are left out, so the thresholds are applied to the 24 that remain: 5 needs 93% or more (23 or more), 4 needs 80% (20), 3 needs 60% (15), 2 needs 33% (8) and 1 is below that.

22 of 24 checks passed, which is 91.7%. Passing: sign-up, log-out and log-in, the emailed password reset (C01 to C03), the three screens by role (C04), the timetable with instructors, capacity and places left (C05, C06), booking, My bookings and cancelling with the place freed (C07 to C09), the full-class rule (C10), the message when a member has no credit (C11), members seeing only their own bookings (C12), the instructor seeing only their classes and members and marking attendance (C13 to C15), the admin adding and deleting classes (C16, C18), every booking, the CSV and the counts per class (C19 to C21), and the Ask the studio form with the admin's list (C22, C23).

Two failed. The admin's Edit class button does not save, so a class can never be changed there (C17). And the owner's name, Dana Okafor, appears nowhere on the site, only "Dana"; the home and About pages also add marketing lines that are not in the brief, such as South Austin and small group classes (C30). No extra class, price or instructor was invented.

• Payments and the declined-card check were not run: they need your own Stripe key.

Sign-up, log-in and password reset for a member, an instructor and an admin on the live app. Then two attacks with the app's own data requests and a member's session: asking for another member's bookings, and calling an admin-only action. I also tried to write the admin table and my own credits.

Every flow worked. The reset email came from Blink within a minute, and its link opens a page on blink.new rather than on the app's own address; the new password worked and the old one was refused. Sign-up has no role choice, so nobody can pick Admin.

Attack 1 was blocked: with member A's session, B's bookings came back as an empty list, an unfiltered request returned only A's own row, and the same request with no session got a 401. Attack 2 was blocked: a delete and a rename on the classes table answered 200 but changed nothing, and the class was still there. A write to the admin table and an update to my own credits were both refused with 403. Staff access is a row added by the owner: my test admin account saw "Your studio access is not set up yet".

• Blink's own security scan was not run, and the terms were not read.

The six data checks: the form and bookings write real records, they survive a reload, a redeploy and a design change, the admin can view, filter, edit and delete them, and they export as a file.

Proved (five): the Ask the studio form and the bookings wrote records; they stayed after reloads, six redeploys and the colour change in E03; the admin viewed, edited and deleted rows (a class edit in the database panel, a class delete in the app); and the bookings exported as a CSV with one row per booking.

Not proved: filtering. The database panel has a search box, but typing a word did not narrow the rows in my run. The panel is a real editor with tables, rows you can add or change, and import and export buttons; I ran the CSV export in the app, not the panel's.

• The panel's own Export button was looked at, not run.

Publish to the vendor address, timed, then three Lighthouse phone runs on the home page of https://fittingroo-app-t94ibxtv.blinkpowered.com.

The Publish button opens a hosting dialog. The first time, it offered a 10K-visits plan that costs 50 credits a month but is free for the first month, and it had an auto-reload switch already on that would charge $40 to a card when the balance runs low. I switched it off before I pressed Deploy Now, and the app answered on its blinkpowered.com address about 12 seconds later. Every later publish took 15 to 20 seconds to show "Your app is live" and cost no credits, though the dialog says 2 to 3 minutes. The pricing page lists custom domains on Starter; I did not try one, and Blink's Domains page says connecting a domain you own is free.

The three phone scores were 66, 68 and 77, a median of 68. The largest contentful paint was about 5.5 seconds and the page weighs about 0.58 MB. The published pages carry a "Made with Blink" badge although the pricing page lists badge removal on Starter; I did not find the switch for it. A timetable with 100 seeded classes, layout faults at three widths and a real phone were not tested.

• Home page only; no domain; no layout fault count.

Looking for a way to take the app out: the code view and its Download button in the editor. I confirmed the download, which costs 5 credits on Starter, then read the files in the code view and built the download in an empty folder outside the repository with its install scripts switched off.

The download is a ZIP of the front end only: a Vite and React app with its pages, no database schema and no data. Its client file points at the Blink project, so the app still reads its classes and accounts from Blink's servers. The install failed at first on a peer-dependency conflict and passed with the legacy-peer-deps flag. The build then failed because React is not listed in the package file; after I added react and react-dom by hand it built, and the result, served from my machine, still loaded the live timetable from Blink. The download is free on Max.

Blink's database panel has import and export buttons, but Blink's support said it needed to check whether a full export of structure and rows is possible on Starter. I did not read the terms.

• I did not run the app against my own database, or read the terms.

One real question through Blink's normal channel, the Send us a message form in the editor, sent at 19:25 UTC on 26 October 2026: how to stop visitors becoming admin, and how to export the database. Starter has no priority support.

A person from Blink replied at 19:29, 4 minutes later. The reply said admin rights must be enforced by the database's Table Rules and not by hiding screens, and pointed to Blink's security page. On the export it said the full export of structure and rows on Starter needed to be confirmed, and it suggested upgrading to Pro or Max for backend access.

Cancelling is self-serve. In Settings, Billing, Cancel Subscription opens seven screens in a row, including a warning that one hosted app will be paused at the period end, two questions that must be answered and a 30% discount offer. The plan page then said the Starter subscription ends on 26 November 2026. I could not see a final invoice yet.

• The 7-day and 30-day checks on the app after cancelling cannot be done yet: the plan runs to 26 November 2026.

The pricing page (monthly and annual views), the Usage page and the hosting and download dialogs were read on 26 October 2026. Blink shows credits, not a price per prompt.

The Starter plan cost $25.00 for the month, paid by the owner, and gives 100 credits plus 5 a day. The whole test used 100 credits, from 105 to 5. The brief's app took 47 of them, in three messages, and the six changes 48. Code download took 5. Production hosting is free for the first month and then 50 credits a month, charged up front, which is half of the Starter allowance. Backend and GitHub are a Pro feature (Pro $50), which the pricing page does not list.

The page and the product disagreed in places: Starter lists custom domains, code download and badge removal without saying they cost credits or need a switch, the auto-reload switch in the hosting dialog was on by default, and the free plan is described as 5 credits a day up to 30 a month. The twelve changes did not fit in the allowance, so a top-up would have been needed to finish.

• Annual billing was read, not bought. Custom domain costs were not tested.