Security check for Bolt.new apps
Shipped it on Bolt? See what shipped with it.
Bolt writes the frontend and the backend in one session, so a key can end up in the wrong half. Paste your URL: we find what is public and give you a prompt Bolt can use to fix it.
First scan is free, no signup and no code access. By scanning you confirm you own this site or are authorized to test it, and agree to the Terms and Privacy Policy.
One key needs rotating before launch.
Built with Bolt · Supabase
- Issues
- 5
- Hardening
- 7
- Checks
- 108
- CriticalSupabase service key is readable in main.jsJS bundle
- HighSource map publishes your src/ folderSource maps
- MediumAnyone can send email as your domainDMARC
- MediumSession cookie set without SecureCookies
- LowNo Content-Security-Policy headerHeaders
Passive external check; application logic (SQLi, IDOR) is not tested.
- checks across headers, TLS, DNS, email and supply chain
- 100+
- secret patterns searched in your JavaScript and source maps
- ~40
- for the first scan, no signup and no code access
- $0
Built in one session. Shipped with everything in it.
VITE_ means public
Name a key
VITE_OPENAI_API_KEYso the frontend can call the API, and Vite copies it into the file every visitor downloads.Debug settings ship too
Source maps turned on to chase a bug stay on in production and hand out your original code, comments included.
The database trusts the browser
With Supabase, the browser talks to your tables directly. A policy loosened during development stays loose after deploy.
Demo replay
A minute of a scan, replayed.
A demo of what runs when you paste a Bolt app’s URL. The scanner has 100+ checks; here are the ones Bolt apps trip on most.
- passnothing visible from outside
- warnworth fixing
- faila finding with a fix prompt
- passstackVite + React detected, Supabase backend
- passtlsCertificate valid, modern TLS only
- warnheadersNo Content-Security-Policy
- warnmaps/assets/index-8c1e.js.map is public
- failsecretssk-proj-…7Fd in /assets/index-8c1e.js
- warnemailNo DMARC record for the domain
- passtablesSupabase tables from the bundleafter verify
What we check on a Bolt app
Where Bolt projects leak most often. Public checks run on every scan; Verified ones after you prove the domain is yours.
Keys behind a VITE_ name
Any variable named VITE_… is copied into the bundle. We search it for about 40 key patterns: OpenAI, Anthropic, Stripe, SendGrid and more
Public
Source maps in production
Maps linked from your scripts that publish your original source, and whether they contain keys
Public
Supabase tables open to anyone
Whether the tables your app references answer without login, with the anon key from your bundle. One row requested, never stored
After you verify
Hosting defaults
Missing Content-Security-Policy, HSTS and clickjacking protection on the deployed site
Public
How it works
From URL to fixed in four steps.
Paste your URL
No code, no login, no setup. The first scan takes about a minute.
Read what a stranger could do
Each issue is explained by its consequence, in plain English, ranked by severity.
Fix with Bolt
Copy the fix prompt for the issue and paste it into Bolt.
Rescan and confirm
Verify your domain for free to unlock the deeper checks, then rescan to see the issue gone.
Free first scan. No signup, no code access.
Before / after
One build setting, before and after.
With source maps on, your original code, comments included, is one download away. Bolt projects are Vite projects, so the fix is a build setting.
MediumSource maps published in productionPublic check
export default defineConfig({ plugins: [react()], build: { sourcemap: true, },});
Finding: /assets/*.js.map returns your source.
The production build publishes JavaScript source maps. In vite.config.ts set build.sourcemap to false, rebuild and redeploy, and make sure no .map file is left in the deployed assets. Then list any secret that appears in src/ so I can rotate it.
An example. Each finding in the report comes with a prompt like this.
Inside the report
A finding, and the prompt that fixes it in Bolt.
Every issue comes with a prompt written for the tool you build with. Paste it into Bolt, redeploy, and rescan to see the finding gone.
Bolt security guideCritical
OpenAI API key found in your JavaScript
Anyone who opens your site can copy the key and run requests on your OpenAI bill.
Found in /assets/index-8c1e.js
The OpenAI key is in the frontend bundle because it is read from VITE_OPENAI_API_KEY. I have rotated the key. Create a server function that calls OpenAI with OPENAI_API_KEY from the server environment, make the frontend call that function, and remove every VITE_ variable that holds a secret.
Compared
Not instead of your other checks. Next to them.
| What | Shypset | Bolt’s built-in scan | Manual pentest |
|---|---|---|---|
| Where it looks | Your live site, from outside | Your project, from inside | Your app, by a security tester |
| Headers, TLS, DNS, email | Checked on every scan | Not covered | Usually covered |
| Works for any stack or host | Yes | Only apps built in Bolt | Yes |
| Logged-in logic (IDOR, per-user rules) | Not tested | Deeper inside the project | Yes |
| Cost and time | First scan free, about a minute | Free, inside the tool | Quoted per project, days to weeks |
Run the built-in scan too: it sees the inside. Shypset shows what a stranger sees.
What a scan looks at
- secretsAPI keys in your JavaScript
- secretsPublished source maps
- headersContent-Security-Policy
- headersCookie flags
- headersCORS rules
- tlsCertificate and TLS versions
- webMixed content
- emailSPF record
- emailDMARC and DKIM
- dnsDNS records
- dnsDNSSEC
- recordsCertificate transparency
- supply chainOutdated JS libraries
- supply chainScripts without integrity
- recordsWeb archive history
Pricing
Your first scan is free, no signup needed. Upgrade when you want the full report and fix prompts for every issue.
Free
For your first check before launch
$0/ month
- 3 scans per month
- 1 free rescan of each scan within 7 days
- Fix prompt for your top issue
- Security grade and severity breakdown
- OWASP Top 10 and CWE mapping
- 7-day history
Pro
For founders shipping AI-built apps
$15/ month
Billed monthly, $180 a year
- Up to 200 scans a month (fair use)
- 1-year history
- Full report for every issue
- Fix prompts for Cursor, Lovable, Claude and more
- HTML and Markdown export
- “Scanned by Shypset” badge for your verified domain
- Weekly monitoring with email alerts (verified domains)
Agency
For agencies and freelancers. Coming soon
Soon
- More domains for client projects
- Reports you can hand to clients
- Need more today? Contact us
Launch Pass
$9 one-time
One domain for 30 days: the full report and every fix prompt, plus 3 rescans. The public report and badge are not included.
Questions
No. Vite writes every VITE_ variable into the JavaScript that each visitor downloads. Keep only public values there and call paid APIs from a server function.
No. Paste the URL of the deployed app. We never see your code or your environment.
The first scan is free, with no signup and no code access. A free account gives you 3 scans a month. The full report and a fix prompt for every issue come with Pro or a one-time $9 Launch Pass.
Without verification we only read what any visitor’s browser can, plus public records such as DNS. Deeper checks, like asking your database tables for a row, run only after you verify that the domain is yours. Verification is free.
No. It is a passive external check: it does not log in and does not test application logic such as SQL injection or IDOR. A clean report means nothing is visible from outside.
Bolt built it fast.
We check what it left open.
Paste a URL and get the report in about a minute. First scan is free, no signup and no code access.
Ask the team behind the scanner.
Real people read every message. Tell us what you need and we will answer by email.
- Questions
- About a scan, a finding, or how a check works.
- Agency and team needs
- More domains, reports for clients, invoicing.
- Security concerns
- A vulnerability in Shypset, or a request not to scan your domain.
Prefer email? Write to info@softdoes.com.