Bolt.new Security Audit

Auth middleware gaps, exposed credentials, rate limiting, and missing security headers — what Bolt builds and what it leaves unconfigured.

What Bolt.new builds vs. what it leaves unconfigured

Bolt.new generates working, deployable applications. The distinction between "what it builds" and "what it skips" is where every security finding lives.

Most common Bolt.new findings by severity

Pre-launch security checklist for Bolt.new apps

Six steps that address the most common critical and high-severity findings before your app reaches real users.

• Add auth middleware to every protected API route. Verify the JWT on the server, not the client. A missing check on one route is sufficient to expose all users' data.
• Move all secrets to server-side environment variables. Search your bundle: grep -r "sk-\|service_role\|secret" ./dist ./public 2>/dev/null. Rotate any key that was ever in a client file.
• Enable Supabase RLS on every table and write owner-scoped policies. Run SELECT tablename, rowsecurity FROM pg_tables WHERE schemaname = 'public'; — every false is a public database. CVE-2025-48757 class.
• Add rate limiting to /login, /signup, /reset-password, and any AI or payment endpoint. Use a middleware package (express-rate-limit, upstash/ratelimit) or your hosting platform's built-in rate limiting.
• Set HTTP security headers. Four headers that block the most common attack classes: Content-Security-Policy, X-Frame-Options: DENY, X-Content-Type-Options: nosniff, Strict-Transport-Security: max-age=31536000.
• Add error tracking and uptime monitoring. Sentry free tier takes 15 minutes to configure and ensures you know about failures before customers do.

CVE-2025-48757 applies to Bolt.new apps too

CVE-2025-48757 is widely cited as a Lovable vulnerability. The root cause — Supabase tables with RLS disabled — is equally present in Bolt-generated apps. Bolt creates Supabase schemas without enabling row-level security. The anon key is in the client bundle. The result is identical: a direct GET request to your Supabase REST endpoint returns all data in unprotected tables.

-- Check your Bolt app's Supabase RLS status:
SELECT schemaname, tablename, rowsecurity
FROM pg_tables WHERE schemaname = 'public'
ORDER BY rowsecurity, tablename;

-- Any row showing rowsecurity = false is publicly accessible
-- Fix: ALTER TABLE your_table ENABLE ROW LEVEL SECURITY;

Frequently asked questions

Is Bolt.new secure?

Bolt.new is a capable builder that generates production-deployable applications. It does not configure the security layer: authentication middleware, rate limiting, CSRF protection, HTTP security headers, and server-side input validation require manual implementation after Bolt generates the code. The Cloud Security Alliance documented 20 security incidents in AI-powered applications in February 2026 alone. All of these gaps are standard hardening steps, fixable once identified.

What does a Bolt.new security audit check?

An LRC Bolt.new security audit covers four dimensions: Security (auth middleware, credential exposure, CSRF, rate limiting, HTTP headers, input validation), Reliability (error handling, uncaught exceptions, graceful degradation), Performance (N+1 queries, missing indexes, bundle bloat), and Monitoring (error tracking, uptime checks, alerting). Methodology: OWASP Top 10, CWE Top 25, CVSS v3 severity scoring.

What are the most common Bolt.new security issues?

In order of severity: missing authentication middleware on API routes (P0), credentials in the client bundle or Git history (P0), Supabase RLS disabled — the CVE-2025-48757 class (P0), no rate limiting on auth endpoints (P1), CSRF protection absent (P1), HTTP security headers not configured (P1), server-side input validation missing (P2), no production error tracking (P2).

Does Bolt.new need a database security check?

Yes. Bolt apps that use Supabase have the same RLS exposure as Lovable apps. Supabase ships with RLS disabled by default on every table. Bolt-generated schemas do not enable it. Any user with the public anon key — which is in the client bundle by design — can read all data in unprotected tables. Run SELECT tablename, rowsecurity FROM pg_tables WHERE schemaname = 'public'; in your Supabase SQL editor and check for false values.

How much does a Bolt.new security audit cost?

A free Launch Readiness Score is available at launchreadycode.com — URL-based, no signup, 60 seconds. The full Launch Readiness Audit Report is $499 one-time, delivered in under 2 minutes. Ongoing monitoring starts at $149/month. Code Care DFY Technical Setup ($1,999 setup fee + $2,999/mo) implements every fix with a senior engineer reviewing every change before it merges.

Sources: CVE-2025-48757 (NVD / Matt Palmer, May 2025); Cloud Security Alliance AI Application Security Report, February 2026; OWASP Top 10 2021; CWE Top 25 2024; Supabase documentation. This page provides general security guidance, not a certification or guarantee.