Is my Bolt app definitely insecure?

Not definitely, and a clean result is a real result we are happy to report.

How do I check the worst one myself right now?

Open your deployed site, view the JavaScript bundles, and search for a string starting eyJ.

I have already spent a lot on tokens trying to fix an auth bug. Why did that not work?

Because the fix is architectural rather than textual. The check needs to move from the browser to the server, and re-prompting rewrites the browser code more elaborately each time.

What does a Bolt engagement usually cost and how long does it take?

The Production Check is free and takes three to five business days.

Platform playbook

Make your Bolt.new app production-ready

Bolt gets a full-stack app running in an afternoon, and it is genuinely good at the first eighty per cent.

Book a Free Call Start with a free check

Bolt.new

Most common critical finding

Authorization implemented as a client-side route guard, so the API answers anyone who skips the interface.

Production Check: Free, 3–5 days
Typical engagement: 2–4 weeks
Hardening from: $2,000, fixed scope

What we find

Where Bolt.new apps break in production

What actually goes wrong, and why you would not have spotted it yourself. These are the findings we file most often, not a generic checklist.

Finding 01
Changing one number in a request returns someone else's data
A login screen, a user object in React state, and routes guarded on the client.
Auth that is a UI state, not a check
Finding 02
Four separate ways to lose the whole database
Service-role key in the client bundle, tables where row-level security was never switched on, unescaped user input rendered as HTML, and no rate limit on the login route.
The same four Supabase holes
Finding 03
What a user typed is gone on their second device
localStorage and in-memory arrays standing in for a database. It survives a page refresh and nothing else.
State that is not storage
Finding 04
The same rule written twice, quietly drifting apart
Long generation sessions drift. You end up with three date formatters, two fetch wrappers, and duplicated business rules that quietly disagree with each other.
Context loss past twenty components

What we do about it

The Bolt.new fix list

Almost none of this is a rewrite. The interface Bolt generated is usually fine and it stays - what changes is what happens on the server behind it, which in most projects is currently nothing.

How the hardening works

Move every authorization decision to the server and prove it with tests
Close the four standard holes: keys, RLS, output escaping, login rate limits
Replace client-side state with real tables, migrations, and backups
Consolidate the duplicated logic that long generation sessions leave behind
Add CI/CD, preview deploys, and rollback so shipping is not a manual export
Deploy to infrastructure sized for your traffic, with monitoring wired up

How it runs

A typical Bolt.new engagement

Durations from real projects of comparable size. The check is free and everything after it is quoted as fixed scope, so you know the price before we start.

1
Production Check
3–5 days
Read-only access to the repository and the Supabase project. We take the deployed bundle apart looking for keys, enumerate every table and policy, and drive each screen from a second test account and from a terminal to see what comes back that should not.
2
Close the criticals
Week 1
Authorization moves to the server and is checked against the record rather than the session.
3
Give it a real backend
Week 2–3
localStorage and in-memory arrays become tables with migrations, constraints and verified backups.
4
Ship and watch
Week 4, then 30 days
Deploy from git with preview environments and one-command rollback, error tracking, uptime checks and structured logs.

No lock-in

What you keep

Everything we produce belongs to you. If you stop working with us tomorrow, nothing stops running and nothing becomes unmaintainable.

Your accounts and your code
The repository, the cloud accounts, the database and the domain stay in your name.
The report, whatever you decide next
Findings, severity ratings, reproduction steps and effort estimates, written for an engineer.
Infrastructure written down
The environment is defined as code in your repository and comes with a runbook: how to deploy, how to roll back, how to restore, and what to check first.
Your Bolt workflow
You keep generating. We put the security-critical paths outside the surface you regenerate and leave the cross-tenant tests running in CI, so a regeneration that reopens a hole fails the build instead of reaching customers.

Questions

Bolt.new questions we get asked

If yours is not here, ask it on the call. The first one is free and there is no obligation afterwards.

Not definitely, and a clean result is a real result we are happy to report.
Open your deployed site, view the JavaScript bundles, and search for a string starting eyJ.
Because the fix is architectural rather than textual. The check needs to move from the browser to the server, and re-prompting rewrites the browser code more elaborately each time.
The Production Check is free and takes three to five business days.