Bolt.new security: what to check before you launch a Bolt app
How secure is Bolt.new?
Bolt.new apps most often leak secrets through the frontend bundle. Any variable prefixed VITE_ is compiled into browser JavaScript, Bolt keeps .env as plaintext in the project tree (readable by anyone with a shared project link), and Supabase RLS is off by default. None of this stops the app from working — which is exactly why it ships.
Bolt.new generates and runs a full app in the browser, often Vite + a backend like Supabase. Its speed is the point, but the Vite build model and shared project links create a specific, repeatable set of exposure patterns.
The common risks in Bolt.new apps
Secrets bundled into the browser via VITE_
In Vite, any env variable prefixed VITE_ is compiled into the client bundle. An API key for OpenAI or Stripe stored that way is readable by anyone in DevTools.
Plaintext .env in the project tree
Bolt keeps .env as a plain file in the project. Anyone with a shared project link can read every secret in it.
Supabase row-level security off
The Supabase anon key only protects data when RLS policies exist; Bolt-generated projects frequently ship with RLS disabled.
Unprotected API routes
A file in pages/api/ or app/api/ is reachable the moment it deploys. AI-generated routes sometimes include an auth check only as a comment.
How to check your Bolt.new app
- Search your built client bundle (DevTools → Sources) for VITE_, sk-, and SECRET.
- Make sure .env is git-ignored and not reachable at /.env on your live site.
- Enable RLS on every Supabase table and add real policies.
- Confirm every API route checks auth in code, not in a comment.
Scan your Bolt.new app before you launch
SafeLaunch checks your repo and live site in about 30 seconds and gives you a prompt to paste back into Bolt.new to fix each finding.
Bolt.new security FAQ
Is Bolt.new safe to use?+–
Bolt.new is a legitimate builder; the risk is the exposure patterns in what it generates — VITE_-bundled secrets, a plaintext .env, and Supabase RLS left off. Check those before you launch.
Why are my Bolt.new API keys exposed?+–
Most likely they were stored with a VITE_ prefix, which bundles them into the browser, or they're sitting in a .env that's reachable through your project or live site. Move them server-side and rotate them.
How do I scan a Bolt.new app?+–
A SafeLaunch scan checks your repo and live site for bundled secrets, an exposed .env, RLS gaps and more, and returns a fix prompt for each issue you can paste back into Bolt.