Is your Bolt.new app exposing data?
Bolt.new turns a prompt into a deployed, full-stack app faster than almost anything else. The catch is that "deployed" and "secure" aren't the same thing — Bolt optimises for shipping features, and the security settings that keep strangers out are the exact steps it skips. Here's what that leaves open, and how to check your app in about ten seconds.
Check your Bolt.new app now
Paste your app's URL. The free scan reads it from the outside and checks your database, secret keys, exposed files and headers. No signup, nothing changed.
Only scan apps you own or have permission for.The short answer
Bolt.new is a legitimate platform, and a properly configured Bolt app can be perfectly safe. But the apps it generates are not safe by default once they hold real data. Bolt builds on Supabase, and like other AI builders it creates your database tables without switching on Row Level Security — so the public key in your app can read your data. On top of that, Bolt's speed comes from generating everything on the frontend, which is exactly where secret keys and source code end up exposed.
What can go wrong in a Bolt.new app
Supabase database readable without login (RLS off)
The big one. Bolt-generated tables usually ship without Row Level Security, so the public anon key can read — and sometimes write — every row. Details in Supabase security.
Secret keys in the frontend
Bolt writes fast frontend code, so any API key or a Supabase service_role key can end up bundled into the JavaScript, visible to anyone who opens DevTools.
Public source maps
Bolt deployments often leave .map source-map files public, which reconstruct your entire source code — business logic, endpoints and comments — for anyone who looks.
Weak authentication
Missing email verification, no rate limiting on login, and permissive rules can allow brute-force attacks and account takeover.
Missing security headers
No Content-Security-Policy, HSTS or clickjacking protection. Hardening, but easy to close.
Bolt.new as a platform is fine — this is about your app's configuration, which is yours to control. The point isn't to avoid Bolt; it's to check independently what it left open before real users find it.
How to check your Bolt.new app
- In the Supabase project behind your app, confirm Row Level Security is enabled with policies on every table — Bolt won't have done this.
- Search your live app's source for secret keys, and check whether
.mapfiles are publicly downloadable. - Or run the free scan below, which checks your database, keys, exposed files and headers from the outside.
Is your Bolt app one setting away from a leak?
Find out in about 10 seconds. Free, no signup, read-only.
Only scan apps you own or have permission for.What to do if you find something
- Turn on Row Level Security in Supabase for every table, with policies for who can read and write.
- Move secret keys server-side and rotate anything that leaked — treat exposed keys as compromised.
- Disable public source maps in your build/deploy settings so your code isn't downloadable.
- Harden auth (email verification, rate limiting) and add security headers.
- Re-scan to confirm nothing is still exposed.
Is Bolt.new safe to use?
Yes — with a few deliberate steps. Bolt gives you a real Supabase backend and a fast deploy, which is powerful and exactly why the defaults matter. Turn on Row Level Security, keep secret keys off the frontend, and disable public source maps, and a Bolt app can be perfectly safe. The scan above tells you, in seconds, whether yours is locked down.