Security scan for Bolt apps
Bolt stands up a full-stack app faster than almost anything, most often on Supabase, and that speed is exactly the risk: the auth and database policies that keep data private are the parts a prompt rarely completes. The default failure is a database that answers to the public key already sitting in your bundle. We scan the app you deployed, from the outside.
Runs on your deployed URL in minutes. No signup, no card, and it never logs in: public surface only.
What Bolt apps typically get wrong
Bolt scaffolds tables to make the UI work, not to lock them down. Unprotected tables are readable by anyone with the anon key in your bundle.
Bolt inlines what the app needs to run. A private key that lands in the browser bundle is exposed to every visitor.
A fast deploy often goes out with no Content-Security-Policy, no HSTS, no frame protection. Quick wins, routinely skipped.
What the scan checks on your live app
We use the anon key your live bundle already serves and check what it can read without a login, table by table.
We scan what your deploy actually sends to the browser for real private keys, and we distinguish them from publishable keys that are safe in the page.
The one-line deploy fixes: CSP, HSTS, frame and content-type protections.
On a Pro scan, with your permission and your test accounts, we sign in as two users and check whether one can reach the other's data, with the request and response as evidence.
Being straight about scope: the free scan sees only what an anonymous visitor sees. Signed-in cross-user testing is a paid scan, needs your explicit permission and test accounts you provide, and takes tens of minutes because we actually drive the app. Plans on pricing.
Already asked Bolt to check its own security?
Asking the AI that wrote the code whether the code is safe is grading its own homework: it has no adversarial view of its own output. An independent scan tests the deployed app the way a stranger reaches it, and a Pro scan proves the one thing no code review can, whether two signed-in users are actually separated at runtime.
Common questions
The free scan only reads your public surface, the same pages and endpoints any anonymous visitor can reach. No logins, no account creation, no writes. Signed-in testing happens only on a paid scan, with your permission and test accounts you provide.
The anon key itself is designed to be public. The problem is what it can read: without Row-Level Security set per table, that public key reads everything. The free scan shows you exactly which tables answer without a login.
Prefer the checklist first? See the Bolt pre-launch checklist.
Platform behavior described as of September 2026. Platforms change their defaults; the scan tests what your app actually does today.