Bolt
Exposed API keys on a Bolt app
Bolt serves a live preview from the project you are editing. That preview is a public address. Code that looks private in the editor is still in the script the preview downloads.
Keys that the browser can already download.
What the scan can see
The scan looks for high-confidence shapes in the HTML, up to 10 same-origin scripts, and a public env file: Stripe secret and webhook keys, OpenAI, Anthropic, AWS access key ids, GitHub and Slack tokens, Supabase service_role JWTs, and private keys. A Stripe publishable key and a Supabase anon key are notes, not leaks. The stored report keeps a short prefix and suffix, not the full secret.
What it does not do
Keys on other hosts, keys assembled at runtime, and keys that never shipped are missed. The scan does not call the provider to see if a key still works.
The scan does not sign into Bolt or read the editor. It only requests the URL you paste and a short, fixed list of paths on that host.
What to do next
Roll a live secret in that provider's dashboard first. Then remove it from client code and from any public env prefix. The $9 report is a paste-ready prompt for Lovable, Cursor, and Bolt that names the file path we saw.
Questions
Does this open my Bolt project?
No. The scan does not sign into Bolt or read the editor. It only requests the URL you paste and a short, fixed list of paths on that host.
Can the scan prove exposed api keys is fully fixed?
Keys on other hosts, keys assembled at runtime, and keys that never shipped are missed. The scan does not call the provider to see if a key still works.
What should I do if the scan finds it?
Roll a live secret in that provider's dashboard first. Then remove it from client code and from any public env prefix. The $9 report is a paste-ready prompt for Lovable, Cursor, and Bolt that names the file path we saw.
Scan a URL you own
The same free check as the homepage. You confirm the app is yours before it runs.