Security audits for Bolt apps.
Apps built on Bolt.new usually run on Supabase, and the public key in your bundle is safe only if row level security is written for every table. We test your live app from the outside, the way an attacker would, and hand you the fixes.
Why it matters
A Bolt app can be prompted into existence in an afternoon, and the interface, the sign-up, the checkout will all work. The rules for who may read and write each piece of data are the part you cannot see, and a missing rule does not cause an error. It produces an app that works and is exposed at the same time. On Supabase that means a table without row level security returns its contents to anyone holding the public key, which is everyone who has visited your site. It is the most common serious finding in the apps we review: not a stolen credential, a published one, working as designed, in front of a table that was never given a rule.
What you get.
Row level security review
Every table checked for RLS being enabled and for policies that actually restrict something. Enabled is not the same as protected, and the dashboard will not tell you the difference.
Outside-in exposure test
We query your backend unauthenticated with the public key from your own bundle and show you exactly which tables and fields respond with data they should not.
Built-bundle secrets check
Environment variables get inlined into the JavaScript at build time, so we search the deployed output, not just the source, for secret and service role keys. A key that has reached the browser is already compromised.
Two-account access test
Signed in as one user, we try to reach another user's records through the app and the API. This is the flaw that exposes every customer to every other customer, and no scan can confirm it.
Auth and endpoint checks
Edge functions callable by anyone, CORS that accepts any origin, missing rate limiting on login. The quieter doors that add up to an account takeover.
Prioritised report and free re-review
Every finding rated by severity with a concrete fix, and a free re-test of the same surface once you have applied them.
How it works.
- 01
Access
You share the app's URL and a short walkthrough of what it does. Much of the test needs nothing more than the public address.
- 02
Test
We probe the live app and its backend from outside, by hand, then review the configuration with you.
- 03
Report
You get a clear, prioritised write-up within days, plus a call to walk through it and the fix for each finding.
- 04
Re-review
After you apply the fixes, we verify the exposed endpoints are actually closed.
Common questions.
- My Supabase URL and anon key are visible in the page. Is that the problem?
- On its own, no. The anon key is designed to be public, and its safety comes from the row level security policies on the tables behind it. The problem is when those policies are missing or permissive, because then the same public key reads the whole table. That combination is what we test for.
- The app works fine. Why would anything be wrong?
- Because none of this is visible from the inside. Most AI-built apps we review have at least one serious access-control flaw, and the owners are rarely aware of it, precisely because the app behaves normally. The exposure only shows to someone using the public key the way an attacker would, which is what the audit does.
- What do you check on a Bolt app?
- Row level security and policy quality on every table, live exposure with the public key, secrets in the deployed bundle, cross-account access with two real accounts, edge functions, CORS and authentication hardening. Every finding comes with a severity and a fix.
- Can you fix the issues, not just find them?
- Yes. We can apply the fixes for you or hand you a clear prioritised list, and we re-test either way. If the app has outgrown the builder, we can also migrate it onto infrastructure you own.
- How much does a Bolt security audit cost?
- It is scoped to a fixed quote up front, with no hourly meter, and typically starts around $750 depending on the size of the app. You will know the price before we begin.
Related services.
Let's build something real.
Tell us about your app or idea. You'll get a clear plan and a fixed quote back within 24 hours.