Bolt.new security

Is my Bolt.new app secure? Check its code and live site

Bolt.new keeps your project in sync with a GitHub repository. SafeWeave scans that repository on each push and checks the URL your app is published at, for the mistakes AI builders make most.

Run a free scan Create a free account

Free scan of a public GitHub repo · no signup · private repos and live apps with a free account

Why it matters

Your Bolt.new app works. Is it locked?

Bolt.new gets you from prompt to working app fast. The security mistakes AI builders make don’t break anything, so you won’t see them while you click around: a table anyone can read, a secret key in the browser bundle, an API route that never checks who is calling. SafeWeave looks for exactly these.

How SafeWeave Solves It

How SafeWeave checks a Bolt.new app

No access to your Bolt.new account needed: SafeWeave scans the GitHub repository your project syncs to.
Each push is scanned, within your plan’s monthly scan limit, so new mistakes show up when they are made.
An App URL scan checks the deployed app from the outside, the way anyone on the internet sees it.
On Cloud and Cloud Plus, every finding comes with how to fix it and a prompt you can paste back into Bolt.new.

What to watch for

Common security issues in Bolt.new apps that SafeWeave checks

Secrets in public env vars

Secret keys in VITE_ or NEXT_PUBLIC_ variables, which end up in the JavaScript every visitor downloads, and keys such as Stripe secret or OpenAI visible in your live website code.

Databases anyone can read

Supabase tables with Row Level Security off or a policy that lets every row through, and Firestore or Realtime Database rules with no condition.

Storage anyone can open

Supabase buckets created as public and Firebase Storage rules with no condition, plus buckets that are public or list their files from the outside.

Routes with no sign-in check

Next.js Route Handlers and Server Actions that change data without checking the user, and Express /admin routes with no auth middleware.

Paywalls checked only in the browser

Paid content behind a flag the browser checks, plans set from what the browser sends instead of Stripe, and Stripe webhooks that don’t verify the signature.

Files that should never be public

From the outside: /.env files, the .git folder, backups and source maps your published site serves to anyone.

Anything checked on your live app, rather than in the code, is a live app check, on Cloud and Cloud Plus. See every check in the vibe coding security checklist.

How to scan

Scan your Bolt.new app in four steps

1
In Bolt.new, click the GitHub icon at the top right, click Log in to GitHub and choose which repositories Bolt can use. Bolt keeps the repository in sync with your project.
2
In SafeWeave, connect GitHub if you haven’t, then go to Repositories, click Connect repository and pick that repository.
3
Click Scan now, or wait for your next change: each sync is a push, and pushes are scanned.
4
Go to App URLs, click Scan an app URL and enter the URL your Bolt app is published at.

Full instructions: Bolt.new in the docs. If the repository is public, you can also try a scan without an account at safeweave.dev/scan.

Code and live app

What each scan looks at

Your code, through GitHub

Connect the GitHub repository your builder syncs to. Each push is scanned, within your plan's monthly scan limit. On top of the standard scanners, 59 vibe-coded app checks look for the mistakes AI builders make with Supabase, Firebase, Next.js, Vite, Express, Stripe, AI features, Python, MCP servers and secrets.

Your live app, from its URL

An App URL scan looks at your deployed app the way anyone on the internet can: security headers, the TLS certificate, email records and exposed files. On Cloud and Cloud Plus it also runs live app checks for open tables, storage, keys and AI routes. They only read; they never change anything.

Plans

What’s free and what’s on Cloud

	Free	Cloud and Cloud Plus
Connected repositories	1	5 on Cloud, 15 on Cloud Plus
Cloud scans per repository a month	5	15 on Cloud, no limit on Cloud Plus
Vibe-coded app checks on your code	Grade and finding counts	Every finding, with how to fix it
App URL scan	Score, grade and the first findings	All findings, with how to fix them
Live app checks (open tables, storage, keys, AI routes)	No	Yes
Daily or weekly monitoring with email alerts	No	Yes
Supabase connection (RLS and security advisors)	No	Yes

Cloud is $29/month with a 14-day free trial; Cloud Plus is $59/month. See Choosing a plan.

Other builders

Built with something else?

Lovable security Replit security v0 security

FAQ

Common questions

Is my Bolt.new app secure?

Using Bolt.new doesn’t make an app insecure on its own, but you can’t tell from using the app whether it leaves data or keys open. AI-built apps often ship the same mistakes: database tables anyone can read, secret keys in the browser and routes with no sign-in check. To find out, scan it: SafeWeave checks the code in the GitHub repository your project syncs to and the live app at its URL.

How do I check my Bolt.new app for security issues?

Put your Bolt.new project on GitHub, then in SafeWeave connect that repository and click Scan now; after that each push is scanned. Then scan the address your app is deployed at under App URLs. A free account covers one repository with a grade and finding counts, and an App URL scan with a score and the first findings; every finding with its fix and the live app checks are on Cloud and Cloud Plus.

Do I need to give SafeWeave access to my Bolt.new account?

No. You don’t connect Bolt.new itself. SafeWeave scans the GitHub repository Bolt keeps in sync with your project, and your published app at its URL.

Which stacks does SafeWeave check in a Bolt.new project?

The vibe-coded app checks cover Supabase, Firebase, Next.js, Vite, Express, Stripe, Python and AI features, plus secrets. Checks for a stack your project doesn’t use simply find nothing.

Scan your Bolt.new app

Paste a public GitHub repository and get a grade with ranked findings in seconds, no account needed. For a private repository or your live app, create a free account.

Run a free scan View on GitHub

Explore SafeWeave

Vibe coding security Security checklist Supabase RLS checker Lovable security Replit security v0 security Docs: AI builder apps Pricing