Bolt.new security checklist
Pre-launch security checklist for apps built with Bolt.new: secrets, auth, database rules, and headers.
Bolt often deploys full-stack prototypes quickly. Check env vars marked for the client, API routes without auth, and any Supabase/Firebase keys in the browser.
Checklist before you share the URL
- [ ] No
service_role,sk_live_,sk-(OpenAI), or AWS keys in client bundles - [ ] Paid API calls go through a server/edge function
- [ ] Every Supabase table has RLS on with real policies (not
true) - [ ] Firebase rules require
auth != nullwhere data is private - [ ]
/.envand/.git/HEADreturn 404 on production - [ ] Auth guards on every API route that reads or writes user data
- [ ] Basic headers: HTTPS, HSTS,
X-Content-Type-Options: nosniff, a CSP you understand - [ ] Re-scanned after the last big AI change
Copy-paste into your AI builder
Review this Bolt.new app for production security. Move all secret API keys to server-side functions. Enable Supabase RLS (or tighten Firebase rules). Block .env and .git on the host. Add auth checks on API routes. Summarize every change you make.
Related: Hide API keys · Fix it and prove it
Scan your app free
Paste your URL. ShipLatch checks for leaked keys, exposed /.env and /.git, and flags Supabase/Firebase so you know what to lock down.