Is your Bolt app secure?
Contents
Bolt writes your app, puts it online and gives it a database: its own, or Supabase. Its security audit checks the database, not the rest of the project. Here is what's left to look at, how, and what Rustine checks for you.
At a glance
| Risk | Where Rustine checks it |
|---|---|
| A key in a VITE_ variable | Free scanGitHub code · Solo, Pro |
| A database left too open | Full audit · Solo, ProSupabase connected · Solo, ProGitHub code · Solo, Pro |
| The service_role key in the front end | Free scanGitHub code · Solo, Pro |
| Published source maps | Full audit · Solo, Pro |
| A live .env or .git | Free scan |
| Missing security headers | Free scan |
1. A key in a VITE_ variable
A variable starting with VITE_ is copied into the published JavaScript. Vite says it plainly: it must never hold an API key.
Check it yourself
Keep your keys in Bolt's Secrets: only your server functions read them. In your code, no secret key behind VITE_.
What Rustine checks
From the free scan, Rustine looks for secret keys (Stripe, OpenAI, Anthropic, service_role…) in the served JavaScript. On GitHub, it spots a key in a VITE_ or NEXT_PUBLIC_ variable.
Free scanGitHub code · Solo, Pro
2. A database left too open
One open permission or one missing RLS policy, and your tables can be read with your app's public key.
Check it yourself
Run Bolt's security audit: it looks for exactly these open permissions and missing RLS policies. On Supabase, look at the Security Advisor too.
What Rustine checks
If your app runs on Supabase: after proof, the full audit counts the rows readable with the anon key, and with Supabase connected, it reads your policies. On GitHub, it reads your migrations. Other databases aren't tested.
Full audit · Solo, ProSupabase connected · Solo, ProGitHub code · Solo, Pro
3. The service_role key in the front end
This key ignores your database's rules. In the browser, it gives everything to everyone.
Check it yourself
In your code, search for SERVICE_ROLE and sb_secret_: server side only. If it was published, rotate it right away.
What Rustine checks
From the free scan in the served JavaScript, and on GitHub in your public variables.
Free scanGitHub code · Solo, Pro
Sources: [5]
4. Published source maps
A source map gives back your readable source code, comments and file names included. A key left in it can be read too.
Check it yourself
Open your browser's developer tools, Sources tab: if you find your original files, the source maps are online.
What Rustine checks
After proof, the full audit opens a few source maps and looks in them for secrets and sensitive paths.
Full audit · Solo, Pro
5. A live .env or .git
Hosted outside Bolt, your app can publish its .env file or .git folder by mistake, with your keys and all your code.
Check it yourself
Open your-site.com/.env and your-site.com/.git/HEAD: you should land on an error page.
What Rustine checks
From the free scan, Rustine checks the usual .env files and the .git folder, reading only their first bytes.
Free scan
6. Missing security headers
Without HSTS, CSP or framing protection, your site defends itself less well against injected scripts and fake sites that frame it.
Check it yourself
On your domain, your host's settings add these headers. Ask your agent to write them for your host.
What Rustine checks
From the free scan: HSTS, CSP, framing protection, nosniff, Referrer-Policy, Permissions-Policy, HTTPS redirect and certificate.
Free scan
Scan your site, it's free
Paste your address: the quick scan reads what a visitor sees, nothing more. The details show once you've proven the site is yours.
Free toolsSupabase checkerSecurity headers test
Questions
Isn't Bolt's security audit enough?
It checks your database, and Bolt notes it doesn't look at the rest of the project. Keys in the front end, exposed files and headers are still to check.
Where do I keep my API keys in Bolt?
In the project's Secrets. Your server functions read them, the browser never does.
Sources
- Vite, Env Variables and Modes, read on 15/10/2026
- Bolt, Secrets, read on 15/10/2026
- Bolt, Bolt Database, read on 15/10/2026
- Supabase, Performance and Security Advisors, read on 15/10/2026
- Supabase, Understanding API keys, read on 15/10/2026