Security for apps built with Bolt
Bolt turns a prompt into a running full-stack app in the browser. Speed like that means the security configuration is yours to add afterwards. Start with a free external snapshot, then check what the outside view can't reach.
Prototype speed, production exposure
Bolt is brilliant for going from idea to working app fast. The risk is shipping that prototype to real users with prototype security: a database open to the public key, secrets sitting in the front-end, and none of the routine web hardening in place. None of it stops the app from working, so it is easy to overlook.
The outside view can’t see this
What an external pass still can't confirm: write access and app logic
The free Surface Check now detects a Supabase or Firebase backend from your front-end and checks, read-only, whether your data is readable without a login, alongside flagging secrets that leaked into your front-end code. What it still can't see is whether that data can be written or changed without permission, and whether your app's own logic enforces who can see what, the flaws that do the real damage once a prototype has real users. Those need the code and the app tested directly.
What the free Surface Check covers for your Bolt app
- Database access: we detect your Supabase or Firebase backend from your front-end and test, read-only, whether any of your data is readable without a login.
- HTTPS and HSTS on your custom domain, so traffic can't be silently downgraded to plain HTTP.
- Security headers (Content-Security-Policy, clickjacking protection, nosniff) on your front-end.
- Your TLS certificate's health and how soon it expires.
- Cookie flags (HttpOnly, Secure, SameSite) on any session or auth cookies you set.
- Email spoofing: SPF, DKIM and DMARC on your domain, so attackers can't send email as you.
- Exposed secrets: common API keys or tokens (such as a Supabase service_role or Stripe secret key) left in the front-end code your site serves to browsers.
See your external surface in about a minute
A free, passive snapshot with an A-to-F Surface Score and every issue scored by severity and fix effort. No sign-up, and nothing is stored.
Run the free Surface Check →Frequently asked
Does the check touch my Bolt app or its data?
It never authenticates, never uses a secret key, and never reads your actual data or writes anything. The passive checks read only your public external surface: response headers, TLS, cookies and DNS. If it detects a Supabase or Firebase backend, it uses the public config your app already ships to test, read-only, whether your data is readable without a login.
How do I know if I have secrets in my front-end?
Anything in client-side code ships to the browser, so any key or token there is readable by anyone. Keep secrets server-side, and treat any key that reached the browser as compromised and rotate it.
Is a fast prototype really worth checking?
If real users or real data touch it, yes. The exact shortcuts that make a prototype quick, open data, in-browser keys, skipped hardening, are the ones that matter once it is live.
Is it free?
Yes, free and with no sign-up, with an A-to-F Surface Score and every issue scored by severity and fix effort.
More free checks