GuardCue

Is my Bolt app safe to launch?

Paste your address. We check your live Bolt app the way a stranger would, then tell you in plain English what could cost you money, and how to fix it.

Free. No sign-up. We check the one page you give us, and only what any visitor can already see.

Could end your business

Anyone on the internet can read your customer list.

what we didasked your site for its customer list, without signing in
what it showedthe whole table, with names, emails and phone numbers
What it means for youNo login, no password, no attacker needed. Someone who finds the address copies the whole table. This is the kind of leak you may have to tell every customer about.
This is how every finding is written. No jargon, ever.
About Bolt

Working is not the same as safe.

Bolt, from StackBlitz, builds and runs a full app from a prompt in your browser. Founders reach for it for the same reason as Lovable: it turns an idea into something real, fast.

Where your data livesA Bolt app usually keeps its data in Supabase, connected from inside Bolt, and can also use Bolt’s own built-in database. Either way the app ships a public key to visitors, and the question is the same: does each table have a rule about who may read it.
What we find

The faults we find in Bolt apps.

Written the way your own report would write them. These live in the app Bolt built for you, not in Bolt’s own service, which is why only a check of your app answers it.

Could end your business

Every customer can read every other customer's records.

What it means for youOne curious user is enough. You never notice, because you only ever look at your own account, and from the inside the app looks exactly right.
what we didmade a new account that owned nothing, then opened the dashboard
what it showedfour records that were not ours
Costs you money

A stranger can run up your bill with nothing to stop them.

What it means for youYour app pays for every text message or email it sends, and nothing limits how often one person can set that off. The invoice is how you would find out.
what we didread the code where your app sends messages
what it showedno limit on how often one person can trigger it
The honest part

What this check cannot see.

Every scanner looks cleaner if it stays quiet about what it missed. We would rather tell you.

Could not check

The free check reads what a visitor could already reach. What one signed-in customer can see across another customer’s account needs a test sign-in, which needs you to prove the site is yours. Anything we could not check is named in your report rather than left looking fine.

What we found ourselves

We scanned 25 Bolt apps.

Not a survey and not somebody else’s research. We read the code of 25 real apps strangers built with Bolt, and published how. The method is here.

Had a key anybody reading the code could copy
Taped to the front door: it can be used as though it were you.
6 of 25
Had something a stranger could run up a bill on
A part that costs money every time it runs, and runs for anybody who asks.
10 of 25
Let a visitor’s typing reach too far
Words typed into a box, treated as an instruction to follow.
4 of 25
If the answer is yes

You found something. Now what?

The fixes are small and the order matters. Close the tables first, because that is the one somebody could use today, then move any key that should not be in the browser, then put a limit on anything that costs you money per use.

The free check names each one and shows the proof. Paying gets you the words to paste back into Bolt for each fault, and a re-check afterwards, so you are not guessing whether the change took.

What a plan adds →

Before you paste your address

Questions from people who built with Bolt.

My app still lives on a bolt.new address. Is that a problem in itself?
Not in itself, but it makes you easier to find. Apps on a builder's own domain are listed and searchable, and that is how researchers found thousands of them in bulk. Your own domain does not make you safe either; it makes you less findable.
Bolt built the whole thing in one go. Can you tell which parts are risky?
We do not guess from how it was built. We open the live app and try things: ask for a table without signing in, read what the page hands out, look at what runs when somebody submits a form. The answer comes from your app rather than from assumptions about the tool.
I connected Supabase but never touched the settings. Is that bad?
That is the common case, and it is why this page exists. A new table starts with no rule about who may read it, and connecting a database does not add one. Nothing is broken, which is why nobody notices.
Check one thing at a time

Free checks for a Bolt app.

Is my database readable by anyone?Check my database →Can one customer see another customer’s data?Check who can see what →Is a secret key sitting in my website?Check for exposed keys →

Where these facts come from

Is my Bolt app safe to launch? · GuardCue