Bolt.new Security Scanner
Is my Bolt.new app secure?
Bolt builds a working full-stack app in one pass, and the fastest way to make a value available to a component is to reference it from client code - which puts it in the bundle every visitor downloads, and leaves validation on the browser side where it can be skipped. This scanner takes your deployed URL and checks what that bundle contains and what your endpoints answer without a session.
What we check on a Bolt.new app
Environment values in the client bundle
Downloads your deployed JavaScript and matches it against key patterns for 30+ providers, plus generic SECRET, API_KEY, and DATABASE_URL assignments.
Read more →Endpoints that answer without a session
Probes common JSON, debug, health, and admin-looking routes to see which respond to an unauthenticated request.
Read more →Missing server-side gates
Watches for routes that never throttle repeated requests, forms posting without a CSRF token, and unexpected HTTP methods left enabled.
Database reachable from the browser
If your app talks to Supabase or a Firebase Realtime Database, we test what those answer to a request carrying only the public key in your bundle.
Read more →.env files and source maps on the host
Requests common paths like .env, .env.production, .git/config, and published source maps that misconfigured static hosting will happily serve.
Headers, CORS, and TLS
CSP, HSTS, and frame protections, wildcard or origin-reflecting CORS, certificate expiry, and mixed content.
Read more →How the Bolt.new Security Scanner works
- Step 1
Paste your deployed Bolt URL
Your live deployment - a Bolt-hosted URL, a Netlify or Vercel domain, or your own. No StackBlitz login, no repository, no environment file, and no Ubserve account.
- Step 2
We read the bundle and press the endpoints
We fetch the page, download every JavaScript bundle it references, and scan the contents for provider keys and env-shaped secrets. In parallel we send unauthenticated requests to common API, debug, and health paths, test CORS by varying the Origin header, look for missing CSRF tokens on forms, and inspect cookies, headers, and TLS.
- Step 3
You get the report, partially unlocked
You see the issue count, a letter grade, and up to two findings in full, free. The rest - including the highest-severity findings and the copy-paste fix prompts - unlocks with a one-time report unlock or a plan.
Frequently asked questions
How do I know if my Bolt.new app is leaking environment variables?
Open your deployed app, open the Network tab, and search the JavaScript files it downloads for the value of the variable - not its name. Bundlers inline env values at build time, so the string appears literally in the output. If you can find your API key by searching the shipped file, so can anyone else, and a variable name that slipped past a public-prefix rule is exactly how a server-only value ends up client-side. This scanner runs that search for you across 30+ provider key formats.
Why does client-side validation not count as security?
Because the client is under the caller's control. Validation in the browser stops honest mistakes and improves the interface, but an attacker does not use your interface - they send the HTTP request directly, with whatever body they want. Anything that must be true has to be checked again on the server, where they cannot edit the code: who is asking, whether they own the record, whether the amount is real. Generated full-stack code very often validates in the form and then trusts whatever arrives at the endpoint.
How does the scanner work?
It runs the standard Ubserve public scan against your deployed URL. We fetch the page, follow its script tags and chunk references, download the bundles, and match them against provider key patterns and env-shaped secret assignments. We separately probe common API, debug, and backup paths, test CORS by varying the Origin header, check forms for CSRF tokens, and inspect headers, cookies, and the TLS certificate. Every request is a read.
Is it free? Do I need to sign in?
The scan is free and you do not need an account to run it. You get the issue count, a letter grade, and up to two findings shown in full - location, evidence, and severity - at no cost. The rest of the report stays locked, including the highest-severity findings and the copy-paste fix prompts you can hand to your AI coding tool. Unlocking everything is a one-time payment for that report, or a plan if you want repeat scans and monitoring.
Does Ubserve see my Bolt project or source code?
No. This scan only reads what your app already serves to the public: the HTML at your URL, the JavaScript bundles that page links to, HTTP response headers, TLS certificate details, and public DNS records. We never ask for a repository, a database password, a service-role key, or an app login, and we cannot see private source code or authenticated pages. When we find a secret in your bundle, we found it because your browser downloads it too - anyone viewing your site can read the same bytes.
Will scanning break my app?
No. Every request this scan makes is a read against your public URLs. We never insert, update, or delete data and we never create an account in your app. Probes go out a couple at a time with pauses between them rather than in a burst, so the traffic pattern looks ordinary rather than like something your host should block.
What founders say
5.0 out of 5 - Ubserve, from 3 reviews
“Helped me find a critical database issue that would've done real damage. I recommend it for every founder.”
“Caught a critical CSP issue on my frontend within minutes. Don't ship without a scan.”
“The free scan took under 60 seconds to find real issues in my project.”
Other free tools
See all tools →
AI BuildersLovable Security Scanner
Checks a published Lovable app for the defaults it ships with: open Supabase tables, keys in the bundle, and ungated routes.
Open tool →Exposed .env Checker
Requests the dotfiles, backups, and source maps your host might be serving, and checks whether env values reached the bundle.
Open tool →
AI Buildersv0 Security Scanner
Checks a deployed v0 app for secrets in serialized props, route handlers that answer anyone, and dev surfaces left on.
Open tool →Keep reading
- Bolt.new security checklistProduction readiness for a Bolt build.
- Are Bolt.new AI agents secure for production?The honest answer, with the caveats.
- How to remove exposed API keys from your frontendGetting a secret back behind a server route.
- Broken access control in AI-built appsWhy the endpoint, not the form, is the boundary.
- Pre-deploy security checklist for vibe-coded appsThe last pass before you ship.
Run the Bolt.new Security Scanner
Paste your URL and see what your app is handing to the public. Free, no account, no repo access.