Security audits for Bolt apps.
We review the backend your Bolt app actually uses, including database permissions, server functions and authentication. Source and configuration review are combined with authorized tests of the running app, with evidence and practical fixes for each finding.
Why it matters
A successful sign-up or checkout tests the intended journey, not every permission around it. We map the app's current database connection and privileged backend paths, then check the allowed and denied operations for each relevant role. Where Supabase is involved, that includes grants, RLS and the application code using elevated access. Public keys are not automatically secrets, and a platform change is not automatically a security fix.
What you get.
Row level security review
Every table checked for RLS being enabled and for policies that actually restrict something. Enabled is not the same as protected, and the dashboard will not tell you the difference.
Outside-in exposure test
We query your backend unauthenticated with the public key from your own bundle and show you exactly which tables and fields respond with data they should not.
Built-bundle secrets check
Environment variables get inlined into the JavaScript at build time, so we search the deployed output, not just the source, for secret and service role keys. A key that has reached the browser is already compromised.
Two-account access test
Using dedicated test accounts, we check allowed and denied access through the app and API. We validate the returned data and stored state against your intended customer boundaries, alongside useful automated checks.
Auth and endpoint checks
Edge functions callable by anyone, CORS that accepts any origin, missing rate limiting on login. The quieter doors that add up to an account takeover.
Prioritised report and free re-review
Every finding rated by severity with a concrete fix, and a free re-test of the same surface once you have applied them.
How it works.
- 01
Access
You share the app's URL and a short walkthrough of what it does. Much of the test needs nothing more than the public address.
- 02
Test
We probe the live app and its backend from outside, by hand, then review the configuration with you.
- 03
Report
You get a clear, prioritised write-up within days, plus a call to walk through it and the fix for each finding.
- 04
Re-review
After you apply the fixes, we verify the exposed endpoints are actually closed.
Common questions.
- My Supabase URL and anon key are visible in the page. Is that the problem?
- On its own, no. The anon key is designed to be public, and its safety comes from the row level security policies on the tables behind it. The problem is when those policies are missing or permissive, because then the same public key reads the whole table. That combination is what we test for.
- The app works fine. Why would anything be wrong?
- Because none of this is visible from the inside. Most AI-built apps we review have at least one serious access-control flaw, and the owners are rarely aware of it, precisely because the app behaves normally. The exposure only shows to someone using the public key the way an attacker would, which is what the audit does.
- What do you check on a Bolt app?
- Row level security and policy quality on every table, live exposure with the public key, secrets in the deployed bundle, cross-account access with two real accounts, edge functions, CORS and authentication hardening. Every finding comes with a severity and a fix.
- Can you fix the issues, not just find them?
- Yes. We can apply the fixes for you or hand you a clear prioritised list, and we re-test either way. If the app has outgrown the builder, we can also migrate it onto infrastructure you own.
- How much does a Bolt security audit cost?
- It is scoped to a fixed quote up front, with no hourly meter, and typically starts around $750 depending on the size of the app. You will know the price before we begin.
Related services and guides.
Know what needs fixing before you ship.
Get a scoped developer review, evidence-backed findings and remediation guidance, with a free re-review of agreed fixes. Fix implementation is quoted separately.