Security for apps built with Bolt
Bolt turns a prompt into a running full-stack app in the browser. Speed like that means the security configuration is yours to add afterwards. Start with a free external snapshot, then check what the outside view can't reach.
Prototype speed, production exposure
Bolt is brilliant for going from idea to working app fast. The risk is shipping that prototype to real users with prototype security: a database open to the public key, secrets sitting in the front-end, and none of the routine web hardening in place. None of it stops the app from working, so it is easy to overlook.
The outside view can’t see this
What an external pass still can't confirm: write access and app logic
The free Surface Check detects a Supabase or Firebase backend from your front-end and flags secrets that leaked into your front-end code. What it still can't see is whether that data is readable without a login, whether it can be written or changed without permission, and whether your app's own logic enforces who can see what, the flaws that do the real damage once a prototype has real users. Those need the code and the app tested directly.
What the free Surface Check covers for your Bolt app
- HTTPS and HSTS on your custom domain, so traffic can't be silently downgraded to plain HTTP.
- Security headers (Content-Security-Policy, clickjacking protection, nosniff) on your front-end.
- Your TLS certificate's health and how soon it expires.
- Cookie flags (HttpOnly, Secure, SameSite) on any session or auth cookies you set.
- Email spoofing: SPF, DKIM and DMARC on your domain, so attackers can't send email as you.
- Exposed secrets: common API keys or tokens (such as a Supabase service_role or Stripe secret key) left in the front-end code your site serves to browsers.
See your external surface in about a minute
A free, passive snapshot with an A-to-F Surface Score and every issue scored by severity and fix effort. No sign-up. We record which domain was checked and keep anonymous result statistics; see our privacy policy.
Run the free Surface Check →Frequently asked
Does the check touch my Bolt app or its data?
It never authenticates, never uses a secret key, and never reads your actual data or writes anything. The passive checks read only your public external surface: response headers, TLS, cookies and DNS. If it detects a Supabase or Firebase backend in your front-end, it notes that but never queries it.
How do I know if I have secrets in my front-end?
Anything in client-side code ships to the browser, so any key or token there is readable by anyone. Keep secrets server-side, and treat any key that reached the browser as compromised and rotate it.
Is a fast prototype really worth checking?
If real users or real data touch it, yes. The exact shortcuts that make a prototype quick, open data, in-browser keys, skipped hardening, are the ones that matter once it is live.
Is it free?
Yes, free and with no sign-up, with an A-to-F Surface Score and every issue scored by severity and fix effort.
More free checks
Go deeper than the free check on your Bolt app
A full Secvura Application Security Review is a hands-on assessment that reaches the inside risks an external check can’t: who can write or change your data, your storage and access-control logic, and the flaws that actually cost teams real money, with a clear plan your team can act on the same day.
£1,200
fixed price · report in 1–2 weeks · reply within one working day
Not ready? Start with the free Surface Check and see the quality of the findings first.