Bolt

Security scan for Bolt.new apps

Bolt.new builds and previews your app inside a browser-based WebContainer, then deploys it out to a normal host. There is no built-in security scan in that pipeline, so whatever the generator wrote is what ships.

Because Bolt projects frequently wire up a backend through environment variables that get inlined at build time, the most common problem is a key that was only ever meant for server-side use ending up in the JavaScript bundle.

Scan your app

Or run it yourself

$pip install overshare
$overshare https://myapp.netlify.app --fail-on high

What usually turns up on Bolt apps

Build-time environment variables in the bundle

Any variable exposed to the client build gets baked into the shipped JavaScript. A secret key added this way is public the moment you deploy.

Missing security headers

Static hosts serve nothing by default. No CSP, no HSTS, no nosniff unless you configure them.

Permissive CORS

Backends generated for local development often accept any origin, and that configuration follows the app into production.

What the scan actually does

It fetches your app the way any visitor's browser would, reads the JavaScript it ships, and checks the headers, certificate and DNS records that go with it. No login is attempted, nothing is modified, and no credential is used that was not already public.

See the full check list →