Is my Bolt.new app secure?
The common security gaps in Bolt.new apps (keys in the bundle, Supabase RLS, exposed files) and how to check each one before launch.
Bolt.new gets a full-stack app running in the browser quickly, often wired to Supabase. The app working is not the same as the app being locked down. These are the gaps worth checking before you share the link.
What usually goes wrong
- Secret keys in frontend env vars. A key in a
VITE_variable ships to every visitor. See VITE_ variables are public. - Supabase tables without RLS, or policies like
using (true)that allow everyone. See enable RLS. - Admin screens hidden only in the UI. See protect admin routes.
- Exposed files after deploy (
/.env,/.git/HEAD, source maps with secrets). - Payments trusted from the client or webhooks without signature checks. See verify Stripe webhooks.
A 10-minute check
- Search your deployed JS for
sk-,sk_live,service_role. - Visit
/.envand/.git/HEADon your domain: both should 404. - In Supabase, confirm every table in
publicshows RLS enabled with real policies. - Make two accounts; as user B, try to load user A's data.
Do a pre-launch security review of this Bolt app: list any secrets in frontend code or VITE_ variables, confirm RLS is enabled with owner-scoped policies on every Supabase table, check that admin pages are enforced server-side, and verify Stripe webhooks check signatures. Fix each issue and list keys I must rotate.
Related: Bolt.new checklist · Fix it and prove it
Scan your app free
Paste your URL. ShipLatch checks for leaked keys, exposed /.env and /.git, and flags Supabase/Firebase so you know what to lock down. The free scan finds the issues; the $29 Fix Pack gives you fix prompts written for your app and re-scans that prove each fix worked.
Want the whole pre-launch process in one place? Get App Security for Vibe Coders, our $9 PDF playbook.