StackSiren for Bolt
Security check for Bolt apps
Bolt (bolt.new, by StackBlitz) builds and runs full-stack JavaScript apps in the browser and can connect Supabase as a backend. Projects are often deployed to Netlify or Bolt's own hosting, or exported and deployed elsewhere.
Common issues to check before launch
- API keys placed in front-end environment variables (VITE_* or NEXT_PUBLIC_*), which are bundled into public JavaScript
- Supabase tables without RLS
- Production source maps that expose your original source code
Practical fixes
- Treat any variable prefixed VITE_ or NEXT_PUBLIC_ as public
- Call paid APIs from a server function (Netlify Function, Edge Function or API route)
- Disable production source maps unless you need them
What StackSiren does
Paste your Bolt app's public URL. StackSiren makes a few normal GET requests and checks for exposed keys, Supabase/Firebase config, security headers, HTTPS, exposed files and SEO basics. The full report includes fix prompts you can paste into Bolt or any AI coding tool.
These are common patterns, not claims about every Bolt app. Many apps have none of these issues.