Built with Bolt

Is your Bolt app safe?

Bolt built it and put it online. Enter the address and we ask your app what a stranger would ask it. No account needed.

What the free check asks your app

Bolt sets up a database when your app needs one: Bolt Database by default, or Supabase if you pick it on a paid plan. Published apps live at an address that ends in bolt.host.

Are secret keys or passwords in what browsers download?
What could happen Anyone can read the key in their browser's tools and use it, so treat it as already known and replace it.
On 16 cases it had never seen, it found 8 of 8 broken setups and called 1 of 8 safe ones broken.
Free checkHow we check
Can your database tables be read without signing in?
What could happen Anyone can download those tables in full.
On 16 cases it had never seen, it found 8 of 8 broken setups and called 0 of 8 safe ones broken.
Free check, with your OKCritical at worstHow we check
Can anyone download files like .env or .git?
What could happen Whoever asks gets your credentials, or your code with every key that was ever committed to it.
On 16 cases it had never seen, it found 8 of 8 broken setups and called 1 of 8 safe ones broken.
Free check, with your OKCritical at worstHow we check
Does your API answer requests from any website?
What could happen A page your signed-in user visits reads or changes their data without them knowing.
On 16 cases it had never seen, it found 6 of 8 broken setups and called 0 of 8 safe ones broken.
Free check, with your OKHigh at worstHow we check

On a Bolt address

Your app lives on Bolt’s domain until you give it one of your own. That changes three things.

The first check runs every question above, on the tick you give it, and shows each finding’s title and how serious it is at once.
For the checks that need your OK, where a finding sits and how to fix it open once you confirm your domain. That takes one DNS record, so it needs a domain of your own instead of your-app.bolt.host.
On your-app.bolt.host we skip the checks of your email records and of subdomains others could claim, because those belong to Bolt.

Put your app on your own domain in Bolt

What we read once your repository is connected

Some mistakes only show in the code. On a paid plan we read your repository too.

Are private keys named so they ship to the browser?
What could happen Anyone takes the key from your site and runs up your AI or email bill in your name.
On 16 cases it had never seen, it found 8 of 8 broken setups and called 1 of 8 safe ones broken.
Paid plan, your repositoryHigh at worstHow we check
Are secret keys written into your repository?
What could happen Anyone who can read the repository, now or later, can use the key.
On 20 cases it had never seen, it found 10 of 10 broken setups and called 2 of 10 safe ones broken.
Paid plan, your repositoryCritical at worstHow we check
Can anyone tell your app a payment went through?
What could happen People get paid features for free or for less, or real payments fail to count.
Paid plan, your codeCritical at worstHow we check

Bolt’s check and ours

Bolt’s own security audit reads your project while you build it. We ask the app you published, from the outside, the way a stranger would.

Bolt

While you build

Reads your project in the editor, before it goes out.

Vallit

Once it is live

Asks the published app from the outside, then again every day.

Both are worth having. Theirs reads your project while you build. Ours checks the live app again every day, and our team can fix what it finds.

What Bolt checks

How often these checks are right

Read the study

We wrote 100 cases these checks had never seen, half broken and half safe, and scored each set once.

of the 7 checks on this page were in the benchmark: 6
broken setups they found the first time: 48 of 50
safe setups they called broken: 5 of 50