Bolt.new app security: what the AI doesn’t check for you
Bolt.new builds and runs a full JavaScript app right in the browser. In one afternoon, you have a product online. But the agent optimises for “it works”, not “it’s safe”: a key pasted to test an API often stays in the published code.
Bolt projects often use Vite and Supabase. Two things to know: any variable prefixed with VITE_ ends up in the JavaScript sent to the browser, and a Supabase database without RLS rules is readable by anyone.
Ten free analyses every month, no card needed. First report in minutes.
Analyse my app for freeThe most common flaws
API keys exposed in the browser
An OpenAI, Stripe or Resend key called from the front end can be read by any visitor, who can then use it at your expense.
Database without access rules
Supabase tables without RLS or with “true” policies: all your users’ data is reachable with the public key.
Vulnerable dependencies
The agent installs npm packages without checking their known flaws. One vulnerable version of a single package can be enough.
Misconfigured live site
No forced HTTPS, no security headers, unprotected cookies: invisible settings that are still exploitable.
What Citadel checks (15 live checks)
Code, dependency and secret analysis against OWASP and CWE. Every flaw comes with a plain explanation and the fix prompt to paste into your assistant.
- service_role key used in client code CWE-798 · A07
- Tables exposed without Row Level Security enabled CWE-284 · A01
- Permissive policies: USING (true) or WITH CHECK (true) CWE-284 · A01
- Secrets in the code and config files (100+ key types) CWE-798 · A07
- npm and Composer dependencies with published CVEs or GHSA advisories A06 · CVSS
- Passwords hashed with MD5, SHA-1 or unsalted CWE-916 · A02
- http:// redirects to https:// CWE-319 · A02
- HSTS present with a sufficient duration CWE-319 · A05
- CSP present, without unsafe-inline or unsafe-eval CWE-693 · A05
- Protection against embedding in another page (clickjacking) CWE-1021 · A05
- Secure, HttpOnly and SameSite cookies CWE-614 · CWE-1004
- CORS open to every site with cookies CWE-942 · A05
- nosniff and Referrer-Policy headers, server version hidden CWE-693 · CWE-200
- Forms sent in clear text, or password passed in the URL CWE-319 · CWE-598
- Forms without an anti-CSRF token, or sent to another domain CWE-352 · CWE-201
Frequently asked questions
How do I analyse a Bolt.new app?
Download the project from Bolt (or push it to GitHub), then upload the archive to Citadel or connect the repository. You can also have the deployed site checked once you’ve proved the domain is yours.
Where should I put my API keys in a Bolt project?
Server side only: a server function or a Supabase Edge Function, with the key in an environment variable without the VITE_ prefix. The browser calls your function, never the API directly.
Is my code kept?
No. It is analysed in an isolated container with no internet access, then deleted as soon as the analysis ends. Only the results are kept, with secrets masked.
How much does it cost?
The Free plan includes ten analyses a month, no card needed. Paid plans add Citadel AI, analysis on every push and team work.
Other guides
Vibe coding security: the checklist before you put your app online