Skip to content

The problem list is free. A fix prompt for each one is $9.

See pricing
Vibe App Watchdog

Bolt

Bolt's preview URL is a public site

The file looks private in the editor. The preview still serves it. Paste that URL if you own the app or you are allowed to test it.

  • Client files with keys in them

    If the preview JavaScript contains a secret key, the scan can see it. Up to 10 same-origin scripts are fetched. Scripts on other hosts are skipped.

  • Open CORS and missing framing headers

    Access-Control-Allow-Origin: * is a finding. So is a page with neither X-Frame-Options nor CSP frame-ancestors.

  • Env and git paths

    One GET each for the three .env paths, /.git/HEAD, and /.git/config. A real env or git body is critical. HTML shells are ignored.

We do not sign into Bolt. After the free list, Watchdog Monitor re-checks the same URL every week for $9/mo.

Scan a URL you own

The same free check as the homepage. You confirm the app is yours before it runs.

Free public scan

After the results

Monitor weekly: $9/mo

The free scan lists what is already public. Watchdog Monitor re-checks that app every week and emails the grade, plus what is new or fixed. Fix prompts stay a separate $9 one-time unlock on the report.

Monitor weekly: $9/mo

Run the free scan first. The monitor button is on the report.

Is Bolt secure? →