Security for apps built with Bolt
Bolt turns a prompt into a running full-stack app in the browser. Speed like that means the security configuration is yours to add afterwards. Start with a free external snapshot, then check what the outside view can't reach.
Prototype speed, production exposure
Bolt is brilliant for going from idea to working app fast. The risk is shipping that prototype to real users with prototype security: a database open to the public key, secrets sitting in the front-end, and none of the routine web hardening in place. None of it stops the app from working, so it is easy to overlook.
The outside view can’t see this
Data and secrets that leak to the browser
The most common serious issues in quickly-built apps are a backend datastore the front-end can read without authenticating, and API keys or tokens embedded in client-side code where anyone can copy them. Both are invisible to an external check: they live in your project and your bundle, so they need checking directly.
What the free Surface Check covers for your Bolt app
- HTTPS and HSTS on your custom domain, so traffic can't be silently downgraded to plain HTTP.
- Security headers (Content-Security-Policy, clickjacking protection, nosniff) on your front-end.
- Your TLS certificate's health and how soon it expires.
- Cookie flags (HttpOnly, Secure, SameSite) on any session or auth cookies you set.
- Email spoofing: SPF, DKIM and DMARC on your domain, so attackers can't send email as you.
See your external surface in about a minute
A free, passive snapshot with an A-to-F Surface Score and every issue scored by severity and fix effort. No sign-up, and nothing is stored.
Run the free Surface Check →Frequently asked
Does the check touch my Bolt app or its data?
No. It is completely passive and reads only your public external surface: response headers, TLS, cookies and DNS. It never authenticates and never reads your database.
How do I know if I have secrets in my front-end?
Anything in client-side code ships to the browser, so any key or token there is readable by anyone. Keep secrets server-side, and treat any key that reached the browser as compromised and rotate it.
Is a fast prototype really worth checking?
If real users or real data touch it, yes. The exact shortcuts that make a prototype quick, open data, in-browser keys, skipped hardening, are the ones that matter once it is live.
Is it free?
Yes, free and with no sign-up, with an A-to-F Surface Score and every issue scored by severity and fix effort.
More free checks