Bolt
A security check for a Bolt app's public URL
Bolt can put a working app on a public address quickly. This check starts from that address. It reads what an ordinary visitor already receives.
You confirm you own the app or have permission to test it. We do not log in as a user of the app.
What this scan actually checks
- The HTML of the URL you paste, including inline scripts.
- Up to 10 JavaScript files linked from that page, and only if they are on the same host.
- Response headers: Content-Security-Policy, Strict-Transport-Security on HTTPS, X-Content-Type-Options, X-Frame-Options or CSP frame-ancestors, Referrer-Policy, Permissions-Policy, and a CORS wildcard.
- Set-Cookie flags when a cookie is present: Secure, HttpOnly, and SameSite.
- A noindex robots meta tag or X-Robots-Tag, the page title, and the meta description.
- Whether /robots.txt and /sitemap.xml exist and are not the HTML app shell.
- Up to 25 same-origin links on the homepage, a few at a time.
- One request each for /.env, /.env.local, /.env.production, /.git/HEAD, and /.git/config.
- The same high-confidence secret patterns we use everywhere else: Stripe secret and webhook keys, OpenAI, Anthropic, AWS access key ids, GitHub, Slack, Supabase service_role, and private keys in the fetched files.
What it does not check
- It does not log in, try passwords, brute-force paths, or query a database.
- It does not read third-party scripts, your Git host, or the builder's project files. If a secret never shipped in the public response, this scan will not see it.
- Supabase Row Level Security and Firebase security rules are not checked. Those stay listed as coming soon until you can prove you own the domain.
What to do with the result
- Preview URLs are still public. A key that is fine on your laptop is not fine in the script the preview serves.
- After you remove a leaked key, roll it in the provider's dashboard. Deleting the line from the project does not un-copy a key that was already public.
Questions
Does the scan change my Bolt project?
No. It only sends HEAD and GET requests to the URL and a few paths on that host.
Why might a clean-looking app still have findings?
Missing headers, a short title, no robots.txt, or a broken homepage link are findings even when no secret is present. They are tagged so you can see which ones matter first.
Scan a URL you own
The same free check as the homepage. You confirm the app is yours before it runs.