Is Bolt safe? A security guide for Bolt apps
Bolt (bolt.new) generates full-stack apps, frontend plus backend, in the browser. Unlike a frontend-only tool, it writes your API routes and server functions too, and the risk moves there: a generated endpoint that fetches or mutates data without checking who is asking. It often pairs this with a Supabase database the client also reads directly.
The Bolt architecture, and where it leaks
Bolt scaffolds real backend routes and functions fast. Speed favors making the feature work, and the authorization check on each route is the step most often skipped: the endpoint returns the record to whoever calls it.
Where Bolt uses Supabase, the browser also queries it directly with the anon key, so a missing Row Level Security policy exposes the table the same way it would in any Supabase app.
What to check on a Bolt app
- Every generated API route and server function checks the caller's session and ownership, not just the UI.
- Admin or privileged endpoints are not reachable by a normal user replaying the request.
- Row Level Security on any Supabase table the client reads.
- No private keys in the frontend, and baseline security headers on responses.
How to check your Bolt app
A code preview cannot tell you whether a deployed endpoint enforces access. ArgosX drives the live app, replays privileged and id-bearing requests as a lower-privileged user, and reports the ones that answer when they should not, with proof and an optional human-verified pass.
Common questions
Are Bolt apps secure by default?
Bolt generates working full-stack apps, but it does not guarantee each generated endpoint checks who is calling it. The most common gap is a backend route (or a Supabase table) that returns data without verifying the caller. Verify authorization on the deployed app before you launch.
Check your own app for this, free.
A free scan runs in minutes, no signup. Where it finds this, it proves it with the request and screenshot, not just a maybe. A human-verified pass is available when you want a person to confirm every finding.