Bolt.new app security checklist
Before you launch a Bolt.new app, check four things: no secret keys in the frontend, database rules that block strangers, no admin pages open without login, and basic security headers. Bolt writes code fast, but it builds what you ask for. It may not add the safety parts you did not ask for.
Step-by-step checklist
- Find where your app keeps keys. Anything starting with
VITE_or used in browser code ends up public. - Move secret keys (Stripe secret, OpenAI, service_role) to a server function or edge function.
- If you use Supabase, turn on RLS for every table and check each policy.
- If you use another database, make sure the browser never talks to it with admin rights.
- Log out and try every admin and API URL. They should return an error, not data.
- Check that forms check input on the server, not only in the browser.
- Add security headers like Content-Security-Policy and Strict-Transport-Security on your host.
- Rotate any key that was ever pushed to a public repo or shown in the browser.
FAQ
Are my .env values in Bolt private?
Only if they stay on the server. Values used in browser code are built into your JS files, where anyone can read them.
What should I do if a secret key leaked?
Make a new key in that service, delete the old one, and move the new one to the server.
Do I need security headers?
They are not a fix for bad data rules, but they block some common attacks. Most hosts let you add them in a config file.
How much does DeployVet cost?
Free check $0, Scan $7 once, Pro $15/mo.
Will DeployVet change my code?
No. We only read and report. You make the fixes.
Check your app for free
DeployVet scans your live site from the outside, like a stranger would. You get a score and the worst issue with a fix.
DeployVet has three plans. The Free check is $0. A one-time Scan is $7. Pro is $15/mo and adds weekly scans and email alerts. For paid plans you pay first, then the scan runs.