Bolt security checklist
Bolt builds and publishes full apps from a prompt, usually a Vite and React front end, often with Supabase behind it. Settings that start with VITE_ are copied into the code every visitor downloads, which is where many leaks start.
Walk this list before you share the link. Each item links to a short scenario with the fix and a prompt to check your own project.
Keys behind a VITE_ prefix
VITE_ means public: the value ships to every browser.
An AI feature anyone can call
An open endpoint that calls a paid AI model is a bill waiting for a bot.
Tables anyone can read
Supabase tables without Row Level Security are readable with the public key.
Other users' records by changing an id
Every lookup by id must check the record belongs to the signed-in user.
Prices and discounts from the browser
The server decides what things cost, never the page.
Payment webhooks anyone can send
A webhook that does not verify its signature accepts fake 'payment received' messages.
A site search engines cannot read
Pages built only in the browser can show up empty to Google.
Run the free checks
Two of the most common leaks take under a minute to check. No sign-up.