Bolt.new security check: is your Bolt app safe?

By LeakPatrol · Updated 23 October 2026

Bolt can take you from a prompt to a deployed app in minutes. The catch is that the app usually works perfectly while quietly exposing keys or data, because nothing breaks when security is missing. These are the problems we see most in Bolt apps, how to check for each one, and how to fix them with a prompt.

What to check first

1. Secret keys in `VITE_` variables

Bolt projects are usually Vite apps. Every environment variable that starts with VITE_ is copied into the JavaScript that every visitor downloads. If Bolt put your OpenAI, Stripe secret or Resend key in a VITE_ variable to make a feature work, anyone can copy it.

Fix: ask Bolt to move that call into a Supabase Edge Function (or a Netlify function) that reads the key from a secret, then rotate the key.

2. Supabase without Row Level Security

Bolt often connects to Supabase. The anon key in the app is public by design; Row Level Security (RLS) is what stops anyone with that key from reading your tables. Tables created during quick iterations are easy to leave without RLS, or with a using (true) policy that lets everyone in.

Fix: in the Supabase SQL editor run select tablename, rowsecurity from pg_tables where schemaname = 'public';. Every row should say true. Then ask Bolt to add policies so each user can only read and change their own rows.

3. The service_role key in the browser

If an admin screen "needed" more access, the Supabase service_role (or sb_secret_) key may have ended up in the frontend. It bypasses every policy, so the whole database is open.

Fix: rotate it in Supabase straight away and move admin actions into an Edge Function.

4. Public `.env` files and source maps

When a Bolt project is downloaded and deployed somewhere else, the .env file sometimes lands in the public folder, and production source maps can expose your original code. Try opening /.env on your live site: you should get a 404 page.

5. Missing security headers

Hosts like Netlify don't add a Content-Security-Policy or HSTS for you. Add them in netlify.toml or your host's settings.

Check your Bolt app in a minute

Paste your live app's address into the free LeakPatrol scan. It looks at your app the way an attacker's browser would and lists every problem with a fix and a prompt you can paste straight back into Bolt. It also runs a launch checklist (page title, link preview, sitemap) that Bolt apps usually miss.

Check your app in a minute

Free, read-only, no sign-up. Every problem comes with a plain-English fix and a prompt for your AI tool.

Get the 10-point checklist

Every check we run on AI-built apps, with how to do each one yourself. Straight to your inbox.

Questions

Is Bolt.new secure?

Bolt itself is a reputable tool, but the apps it generates can still contain security mistakes, such as secret keys in VITE_ variables or Supabase tables without Row Level Security. Each app needs checking before real users arrive.

Are VITE_ environment variables secret in a Bolt app?

No. Anything in a VITE_ variable is bundled into the JavaScript every visitor downloads. Only put public values there, such as your Supabase URL and anon key.

How do I check my Bolt app for leaked API keys?

Open the live app, go to DevTools, search all JavaScript files for prefixes like sk-, sk_live_ and service_role, or paste the app's URL into a free read-only scanner like LeakPatrol.