for apps built with Bolt
Bolt builds in the browser and ships to Netlify or Bolt's own hosting, usually with Supabase behind it. Fast, and easy to publish something you did not mean to. We check the live app, and its code if it is on GitHub, and hand you prompts Bolt understands.
Free for one app. No card, no install.
what usually goes wrong
Vite builds every VITE_ variable into the JavaScript. A Stripe secret key or the Supabase service_role key in there is a key anyone can use.
Asking Bolt for "an AI feature" can produce code that calls OpenAI from the page itself. That only works by shipping your key to every visitor.
Out of the box, a static deploy sends none of the headers that tell browsers to be careful. One prompt adds a _headers file with HTTPS-only, frame protection and a content policy.
When Bolt wires up Supabase, the anon key goes in the front end, which is fine only if every table has Row Level Security. If your project is on GitHub, we read its migrations and flag the tables that do not.
the fix is a prompt
The most urgent thing we find in Bolt apps, and the prompt that comes with it:
The service_role key skips every RLS rule. With it, anyone can read, change or delete all of your data.
Rotate the service_role key in your Supabase project settings too: the old one has been public.
Security fix: my Supabase service_role key is in the front-end code.
Remove it from every front-end file and from any VITE_ environment variable. The front end must only use the anon key.
Anything that really needs service_role access should move into a Supabase Edge Function that reads the key from Supabase secrets. List every place you changed.
verify your app
Bolt projects are Vite apps, and Vite copies the public folder into the build as-is, so the file proof works on Netlify, on bolt.host and on a custom domain.
Add a site verification for VibeProtect. Create the file public/.well-known/vibeprotect.txt containing exactly this single line:
vibeprotect-verify=3kQ9xZr1VbN0aT7mYw2cLp8e
Also add this tag inside <head> in index.html (or the root layout's metadata):
<meta name="vibeprotect-verification" content="vibeprotect-verify=3kQ9xZr1VbN0aT7mYw2cLp8e" />
Do not change anything else.
Your real token is in the app once you add it. The file ends up at /.well-known/vibeprotect.txt.
questions
The one people visit: your .netlify.app address, your .bolt.host
address, or your custom domain. Each is a separate app to us, because each is a separate
place someone could find a problem.
Yes, if the project is on GitHub. Connect the repo on a paid plan and we scan it for committed keys, vulnerable packages, Supabase migrations without RLS and risky code patterns.
No. We never connect to it. The live scan looks at what your site sends to visitors, and the repo scan reads your migration files. Nothing is ever written anywhere.
One app is free, no card. The hardest part is asking Bolt to add a file.