Is my Bolt app safe to launch?

What Bolt already does for you

• Bolt Cloud hosts your project and includes a free address ending in bolt.host. Custom domains need a paid plan, and on the Free plan every published site is public.
• Your database settings have a Security tab (on all plans) that uses the same checks as Supabase's Security Advisor, such as a missing RLS policy or a rule that's too open.
• If your site has no sign-in, Bolt may write database rules that let any visitor view, add, change, and delete data. The Security tab flags these as "RLS Policy Always True".
• Keys for outside services go in the database's Secrets tab, where your server functions can read them without sending them to the browser. Paid plans can also run a security audit from the Publish menu.

Bolt's Security tab checks your database. Throttle Bird checks your published site from the outside: keys that ended up in the page, security headers, HTTPS, link previews, and whether your data answers a stranger who only has the public key.

6 checks before you share the link

1. 1. No "RLS Policy Always True" on private data

   Why it matters: That warning means anyone who visits your site can read, change, or delete rows in that table, even without using your screens.

   How to check: Click the database icon at the top center of your Bolt project, then Security. Read every warning. Open it again after each database change.

   Fix prompt to paste into Bolt

   Copy prompt

   Check that row-level security is on for every table in my database, and that each policy allows only the access my site needs. Visitors should only be able to view public content and add rows to forms like contact messages. Private data should require sign-in.

2. 2. Private data is behind sign-in

   Why it matters: Database rules can only limit data to the right person if your site knows who each visitor is.

   How to check: List the tables that hold orders, messages, or account details. Each one should need a signed-in user.

   Fix prompt to paste into Bolt

   Copy prompt

   Add email sign-in to my site. Then update the policies for every table with private data so only signed-in people can view, add, change, or delete their own rows.

3. 3. Secret keys live in Secrets, not in code

   Why it matters: A key pasted into your code or into a public environment variable gets copied into the page, where anyone can take it.

   How to check: Open the database icon → Secrets and check that every paid service's key is there. Names starting with VITE_ or NEXT_PUBLIC_ are public by design, so a secret should never use those prefixes.

   Fix prompt to paste into Bolt

   Copy prompt

   Find every API key or password used in this project. Move each secret into the Secrets tab and use it only from a server function. Make sure no secret is in frontend code or in an environment variable that starts with VITE_ or NEXT_PUBLIC_.

4. 4. Leaked-password protection is still on

   Why it matters: It blocks sign-ups that use passwords from known data breaches. Bolt turns it on by default, but it can get switched off.

   How to check: If the Security tab shows "Leaked Password Protection Disabled", it's off.

   Fix prompt to paste into Bolt

   Copy prompt

   Turn leaked password protection back on for my database's sign-in settings.

5. 5. A real address and a proper link preview

   Why it matters: Bolt gives your first publish a random bolt.host name. A clear name, page title, and preview image make your link look trustworthy.

   How to check: In the Publish menu, click the pencil next to your URL to rename it. Then text your link to yourself and check the preview.

   Fix prompt to paste into Bolt

   Copy prompt

   Give every page a unique title and meta description, and add Open Graph tags with a 1200x630 share image so my link shows a proper preview.

6. 6. Test it like a stranger

   Why it matters: You've only ever used your app as its builder. New visitors take paths you never tried.

   How to check: Open your live link in a private window on your phone. Sign up, try the main feature, and try to break any payment with a declined test card.

   Fix prompt to paste into Bolt

   Copy prompt

   Add friendly error messages for failed sign-ups, failed payments, and network errors, so users always see what went wrong and what to do next.

What the free scan checks on your live Bolt app

• Secret keys sitting in your page or its JavaScript files (Stripe, OpenAI, Anthropic, Supabase secret and service_role keys, GitHub, AWS, Google, private keys).
• If your page already exposes its Supabase or Firebase settings, one read-only test with the public key to see if a stranger can read your tables. Rows are never stored.
• Missing security headers that block injected scripts and click-jacking.
• HTTPS, certificate expiry, and whether plain http:// redirects to https://.
• Page title, description, link-preview tags, robots.txt and sitemap.
• How fast the page loads, page size, and JavaScript files that fail to load.

The scan only reads your public site. It never logs in, submits forms, or changes anything. It can't see inside your Bolt project, so it doesn't replace testing sign-up and payments yourself.

Scan my Bolt app free

Questions

Can I scan a bolt.host address?

Yes. Paste your published bolt.host link or your custom domain. The site has to be public.

Bolt's Security tab is clean. Am I done?

That tab only checks your database. Run the free scan too, since it checks what your live page sends to visitors, like keys and security headers.

Does the scan change my data?

No. It only reads public pages and makes at most one read-only test request per table. It never writes anything.