PricingBlog Free scan

Is Bolt.new a Framework? What It Actually Is and What It Generates

By Jai Mittal, CTO ·

Bolt.new is not a framework. A framework is a collection of libraries, conventions, and tools that developers use to build applications. Bolt.new is an AI coding agent: you describe what you want in plain language, and it generates an application using established frameworks and libraries.

What does Bolt.new actually generate?

When you build with Bolt.new, the output is standard code: React or Next.js on the frontend, typically with Tailwind for styling; Supabase, Firebase, or another BaaS for the backend and database; Vite for bundling. Bolt generates this code in a browser-based environment, runs it in a WebContainer, and lets you deploy to Netlify, Vercel, or similar hosting.

The code Bolt produces is real production code in the same way that code a human developer writes is real production code. It runs the same JavaScript, uses the same npm packages, connects to the same database. There is nothing magic or different about how Bolt-generated code executes at runtime.

What makes Bolt-generated apps different from a security perspective

The difference is not in the frameworks themselves but in the configuration choices the AI agent makes by default. Several consistent patterns appear across Bolt-generated apps:

These are not framework bugs. They are configuration and implementation choices the AI agent makes when optimizing for getting a working app in the shortest time. The frameworks Bolt uses (React, Next.js, Supabase) all have the security capabilities built in — Bolt just does not always enable or configure them by default.

The security implication for founders

Because Bolt generates real code with real frameworks, the fixes for Bolt-generated security gaps are standard developer fixes. You add a rate-limiting middleware. You configure CSP headers on your host. You add a Supabase RLS policy. None of this requires replacing Bolt or switching frameworks.

What you do need to know is which gaps the Bolt generation process is likely to have left. That is what platform-aware scanning provides — it knows Bolt’s specific generation patterns and checks for the exact gaps those patterns leave behind.

Check your app now — free

Platform-aware scan: security, reliability, performance, monitoring. 30 seconds, no code access.

Run the free scan

FAQ

Is Bolt.new built on a specific framework?

Bolt.new generates apps using standard frameworks — typically React or Next.js on the frontend, with Supabase or Firebase for the backend. Bolt itself is not a framework; it is an AI agent that generates code using these established frameworks.

Is code from Bolt.new safe to use in production?

Bolt-generated code is production-grade code using real frameworks. The security gaps are not in the frameworks but in the configuration choices Bolt makes by default: absent rate limiting, missing security headers, sometimes-unguarded API endpoints. A pre-launch security scan catches these gaps before they become production incidents.

Does Bolt.new generate secure code?

Bolt generates working code. Security configuration — headers, rate limiting, access controls, monitoring — is often absent because it was not part of the generation prompt. Bolt optimizes for speed and correctness, not security configuration. A security audit identifies what needs to be added.

What frameworks does Bolt.new use?

Bolt.new primarily generates React or Next.js frontends with Tailwind CSS, Vite bundling, and Supabase or Firebase for the backend. The exact stack depends on the prompt and the project requirements you describe.

Research sources