Bolt
Is Bolt secure?
Bolt is not a security product, and it is not automatically unsafe. Bolt serves a live preview from the project you are editing. That preview is a public address. Code that looks private in the editor is still in the script the preview downloads.
The scan does not sign into Bolt or read the editor. It only requests the URL you paste and a short, fixed list of paths on that host.
A useful check is the deployed URL
Paste a URL you own. The scan is passive. It does not log in, brute-force paths, or query a database. Supabase Row Level Security and Firebase security rules are not read. Those stay marked as coming soon.
- Bolt: Exposed API keys
- Bolt: Supabase RLS
- Bolt: Firebase security rules
- Bolt: Missing security headers
- Bolt: Open CORS
- Bolt: Exposed .env files
- Bolt: Auth misconfiguration
- Bolt: Cookie flags
- Bolt: Clickjacking protection
- Bolt: Exposed git metadata
- Bolt: Missing robots.txt
Is Bolt secure?
Bolt is a way to build an app. The security question is about the URL you publish. Bolt serves a live preview from the project you are editing. That preview is a public address. Code that looks private in the editor is still in the script the preview downloads.
What does a free scan cover?
The public page, up to 10 same-origin scripts, headers, cookies, robots.txt, sitemap.xml, homepage links, and five paths: /.env, /.env.local, /.env.production, /.git/HEAD, and /.git/config.
What will a scan of a Bolt URL miss?
The scan does not sign into Bolt or read the editor. It only requests the URL you paste and a short, fixed list of paths on that host.
Scan a URL you own
The same free check as the homepage. You confirm the app is yours before it runs.