For Bolt.new builders
Security audit for Bolt.new apps before you launch
Bolt builds full-stack apps in the browser and deploys them in minutes. The speed comes from letting the model decide where secrets go and which routes need auth, and those are exactly the two decisions that matter once the app is public.
VibeAudit reads the repository you push from Bolt and reports, with file and line, what an attacker or a curious user could do on day one.
Scan your Bolt.new app now — free, under a minute, no signup
Paste the GitHub repository URL. Public repos work as-is; sign in with GitHub for private ones.
What Bolt.new apps usually ship with
From our audits of real repositories. Every item below is something the deep audit reports with file and line, plus a fix prompt.
Keys pasted into a component or a `VITE_`/`NEXT_PUBLIC_` variable ship to every browser. We see OpenAI, Stripe and Supabase keys most often.
Prices, user ids and roles taken from the request instead of the session let anyone pay $0 or act as someone else.
An unauthenticated `/api/generate` is an open credit card for your model provider.
Routes gated by `NODE_ENV` or nothing at all, which reset or expose data in production.
Read before you launch
- Unbounded AI endpoints: paying for someone else's prompts →
- Trusting the client: prices, roles and scores sent from the browser · coming soon
- Secrets committed to the repo and hardcoded credentials · coming soon
- API routes and server actions with no auth check →
- Missing ownership checks (IDOR): reading and editing other users' data · coming soon
- Supabase service-role and secret keys leaking to the browser · coming soon
- Stripe webhooks, idempotency and billing logic bugs →
FAQ
- My app is deployed from Bolt, not GitHub.
- Use Bolt's Export or GitHub sync to get the code into a repository, then paste the URL. We need the source, not the deployed site.
- Will it understand a Vite + Express app?
- Yes. The audit is framework-agnostic; it reads routes, middleware, config and env handling in any JS/TS, Python, Go or Ruby project.