Bolt app security check
Shipped something with Bolt? Paste your live link and get a free score before you share it. Under a minute, no sign-up.
Only scan apps you own or have permission to scan.
What to check on a Bolt app
Bolt gets you from prompt to live app fast. The slips that follow are usually the same: a secret key pasted into the frontend, a .env file deployed by accident, and no security headers.
If your app uses Supabase, Row Level Security on each table is what protects your data.
What the free scan checks
- Leaked keys in your frontend
Your page HTML and up to 15 of your own JavaScript files are checked for Stripe live secret and restricted keys, OpenAI, Anthropic, AWS, GitHub, Slack and Resend keys, Google API keys and private key blocks. Anything found is masked in the report.
- Supabase service_role key
A Supabase service_role key in your client code is flagged as critical. That key skips Row Level Security entirely.
- Open tables (owner opt-in)
If you use Supabase, tick the extra box and we ask 15 common table names (like users, profiles, orders) for 1 row using your public anon key. Row contents are never stored or shown.
- Files left on the server
Things like /.env, /.env.local, /.env.production, /.git/config, .npmrc, docker-compose.yml, backup files, and package.json or lockfiles.
- Public source maps
We check whether a source map for one of your JavaScript files can be downloaded, which would expose your original source.
- Security headers and CORS
HSTS, Content-Security-Policy, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, and wildcard CORS with credentials.
Pre-share checklist
- Open your app logged out. Use a private window. Anything you see there, anyone can.
- Keep secret keys server-side. Only publishable keys belong in the browser.
- Turn on RLS if you use Supabase. Add per-user policies to every table.
- Don't deploy .env files. Make sure /.env returns a 404 on your live site.
- Add security headers. Start with HSTS and a Content-Security-Policy.
- Run the free scan. Fix anything critical or high first.
FAQ
- Do I need to sign up?
- No. Paste your link, confirm it's your app (or you have permission), and run it. Adding your email is optional and shows the risk breakdown and one problem by name.
- What does it cost?
- The scan and your score are free. The full list of findings with a fix for each is a one-time $9, or $29 for a pack of 10 reports.
- Does it attack my site?
- No. It only makes ordinary read requests, sends no exploit payloads, and never logs in or submits forms.
- What doesn't it check?
- Pages behind a login, third-party scripts, your server code and your database policies directly. A good score is not a guarantee of security.