Whatever part of your Bolt app runs in the browser is shipped to the browser, and code shipped to the browser keeps no secrets from the person running it. That bundle is the first thing we read, because every visitor's device already holds a copy.
Leave your app URL for a free first check — we run it and email you the result — or read the 41-point checklist we run against every app.
Bolt publishes projects to Bolt hosting by default and to Netlify instead if you connect it — either way the client build is served straight to the visitor. What that costs you in secrets is not our claim to make: Vite's own documentation says variables prefixed with VITE_ are exposed in client-side source code after bundling and should not contain sensitive information such as API keys. We read what your published build actually contains.
When the browser talks straight to a database or a third-party API, that service's own rules are the entire access control layer — there is no server of yours in between to refuse a request. We test those rules from the outside, with the same key your app hands out.
Removing a credential from the next build does not unpublish the last one. Caches, forks, and anyone who already loaded the page still hold it. Anything we find in a build is treated as public from the day it shipped, and the fix is a new credential.
Yes. An Audit ($690) hands you the fixes as instructions, written in a form Bolt can regenerate around, and tells you which ones a later prompt is likely to walk over. On Production Readiness ($2,450) we apply those changes ourselves, the same way.
More than usual. Keys in a bundle and open backend endpoints do not need an account to be reached, so an app with no users to protect can still have data worth taking.
For the free first check, the published URL. For an audit, the project's code — a connected repository or an export — plus read-only access to whatever backend it talks to. We sign an NDA before anything.
A free first check, an audit at $690, and a checklist you can compare with anyone else's.
SEE PRICING
