Bolt builds and runs a full app in your browser and deploys it in a click. What it can't do is care about the things you didn't ask for, and nobody prompts for security headers or a privacy policy.
Bolt most often scaffolds a Vite, React and TypeScript app (sometimes Next.js), commonly with Supabase as the backend, and deploys to Netlify or Bolt's own hosting.
What Bolt gets right
- HTTPS comes with the hosting.
- Environment variables are supported, and only ones with the VITE_ prefix are exposed to the browser.
- The generated code is yours: you can export it and fix anything.
What Bolt apps usually ship without
- A secret key is baked into your JavaScript filesAI-written code often hardcodes example keys, or puts a secret behind a VITE_ prefix, which publishes it to every visitor.
- Private config files are downloadableA .env file that ends up in the published folder is downloadable by anyone who types the address.
- No rules about which scripts can run on your siteNetlify sends no Content-Security-Policy unless you add a _headers file or netlify.toml rule.
- Clickjacking possible: others can embed your siteSame story for clickjacking protection: it's one line in _headers, and it's almost never there.
- Your original source code is downloadableProduction builds that ship source maps let anyone download your readable source.
- No cookie consent, but you're tracking visitorsAnalytics added late in the build, with no consent step in front of it.
- Missing terms of serviceNo written rules for your product, which matters the day someone disputes a charge.
vibeliq checks all of these, and 31 more, from the outside: see every check.
Two checks to do by hand
An outside scan, ours included, reads what a visitor’s browser receives. These live inside your accounts, so they need your eyes:
- Open your Supabase dashboard and go to Database, then Tables (or Table Editor).
- Every table should show row-level security as enabled. A table without it can be read, and usually written, by anyone who has your public key, and that key is in your site's JavaScript by design.
- Enabled isn't enough: open Authentication, then Policies, and read each policy. A policy of 'true' for everyone is the same as no protection. Rows should be limited to their owner, for example where user_id matches the signed-in user.
- Secrets you set inside Bolt don't travel to your host automatically. Open your Netlify (or Vercel) site settings and confirm every environment variable exists there, and that none of the secret ones start with VITE_.
- Search your project for service_role. That key bypasses every rule and must only exist in server code and server-side secrets, never in the browser.
Questions people ask
Is a VITE_ environment variable secret?
No. Anything starting with VITE_ is copied into the JavaScript your visitors download. That's correct for public values like a Supabase anon key, and a leak for anything the provider calls secret.
Where do security headers go on a Bolt app?
On Netlify, in a _headers file in your publish folder or in netlify.toml. Your vibeliq report gives you the exact prompt to add them for your setup.
Does vibeliq need my code?
No. You paste your live or preview URL. We open it in a real browser and read what a visitor's browser receives, including your JavaScript files.