Bolt.new app security checklist

Updated

Is my Bolt.new app secure enough to launch?

Bolt builds Vite apps, so check first that no secret key sits in a VITE_ variable or front-end file. Then check that every Supabase table has row level security with owner policies, that every server function checks who is calling, that payments are confirmed by a verified webhook, and that AI or email features need a login and have a per-user limit.

Keys first

When you ask Bolt to "add OpenAI" or "add Stripe", the quickest working version calls the service straight from the browser with the key in a VITE_ variable. It works in the preview and the key ships to everyone. Search your project for VITE_ and for the strings sk_live_, sk-proj-, sk-ant- and service_role.

Database rules

Paste your Supabase migrations into the free policy checker to see who can read and change each table.

  • Every table in the public schema has row level security enabled
  • Policies compare a user id column to auth.uid(), not USING (true)
  • Users cannot update columns like role, plan, credits or is_admin
  • Files that are private sit in a private storage bucket

Server functions and payments

  • Each Edge Function or API route checks the logged-in user, a secret, or a webhook signature
  • The price comes from the server or Stripe, never from the request body
  • Paid status is set only by a verified webhook

Costs

  • AI calls need a login, a per-user daily limit and max_tokens
  • Contact and invite forms have a CAPTCHA or login and cannot send to any address
  • A spending limit is set in the AI provider's dashboard

Before you share the link

  • Privacy policy and terms
  • Database backups on
  • Error monitoring
  • Password reset tested
  • The Netlify or hosting deploy has no .env file in its public folder

Questions

Does Bolt check security for me?

Bolt focuses on building the app. Supabase's Security Advisor flags tables without row level security, but neither reads your front-end code for keys or checks your server functions.

Can I paste fixes back into Bolt?

Yes. Every Redproof finding comes with a prompt written for AI coding tools, so you can paste it into Bolt and review the change.