Check your Bolt app before you launch it. Start free.
Bolt.new gets an app online in minutes. Before customers use it, check what it exposes: keys in the code, an open database, public source code, and screens a normal user shouldn't reach.
Free from the outside in minutes. Behind the login when you're ready, on your test copy.
What we check in Bolt apps
The things Bolt apps most often need fixing before launch. The free check covers the first four from the outside; the paid checks sign in and cover the rest.
API keys in the code
Keys for OpenAI, Stripe or your database often end up in the files the browser downloads. Anyone can copy them from there. We check every script the app loads.
An open database
Bolt apps often use Supabase or Firebase. We check whether tables and collections answer without signing in, and, with the paid checks, whether users can read each other's data.
Source code and private files left online
Source maps publish your original code, and files like .env can hold passwords. We check the usual places.
Default Bolt settings
Titles and descriptions like “Created with Bolt”, and sharing images from bolt.new, show up in search results and link previews.
Screens a normal user shouldn't reach
With the ₹299 check, we sign in as a normal user and try admin screens and other customers' records.
Three ways to check your app
Start free, from the outside, the way any visitor sees your app. Then let us in as a test user to check the app itself, or as two or three users for the audit-ready check.
Security from the outside
- Secret keys in your app's code, and databases anyone can read
- Private files left online (.env, .git), published source code
- Security headers, sign-in cookies and the certificate
- API docs, diagnostics and folders open to anyone
- Libraries with known vulnerabilities, error pages that leak details
- Load speed, and your public pages if you have any
The product itself
- Access control: can a normal user reach admin screens or other customers' data?
- What your server sends the browser: password data, codes, secret keys
- Personal data in addresses or sent to third parties; cookies, CORS, GraphQL
- Errors, failed requests and broken screens
- Numbers and calculations checked across every screen
- Usability and layout on a computer and a phone
Offered on your report once the free check sees an app. Money back if we can't sign in.
Audit-ready check
- Everything in the ₹299 check
- Two or three test users: every request repeated as each one, to see who can read what
- Safe security tests on your test copy, such as injection and cross-site scripting
- Sign-in, sessions and tokens
- Accessibility (WCAG 2.2) and India's data protection law (DPDP)
- OWASP, WSTG and ASVS references on every finding, and a free re-check after you fix things
Runs on a test copy of your app, with your written permission. Full refund if we can't complete your report.
Your app, your data, your call
Look, don't touch
The free and ₹299 checks only open screens. They never press save, send, pay or delete, and skip anything that signs out or removes data. The audit-ready check adds safe tests, on your test copy only.
Nothing kept
No screenshots or page content are stored, and we delete our copy of the test user's password when the check ends. Our AI reviews each screen during the check, then it's discarded.
You're in control
It's a test user you add, and you delete it when the check is done. We never ask for your password or your customers'.
Money back
If we can't sign in after three tries, or you cancel before it runs, you get a full refund.
Check your test copy, not your live app
A test copy (often called UAT or staging) is a second copy of your app with its own data, where changes are tried before customers see them.
We'll ask which copy to check before you pay. If you don't have one, we'll still check your live app and flag it in your report: without a test copy, every change and every test happens where your customers are.
FAQ
Does Bolt check my app's security?
Bolt focuses on building. We check the live app the way your users and an attacker see it: from the outside for free, and signed in with the paid checks.
My Bolt app is on Netlify or my own domain. Does that matter?
No. Enter whichever address your users visit. We detect the app and what it uses (Supabase, Firebase and others) from the live site.
Do you need my Bolt or StackBlitz login?
No. We only need your app's address. For the paid checks you add a test user to your app.
Can I paste the fixes into Bolt?
Yes. Each finding says what to change in plain words, ready for Bolt's chat or your developer.
What's free and what's paid?
The check from the outside is free: your grade and top findings straight away, and the full list when you leave your email. The signed-in check is ₹299 and the audit-ready check is ₹999, both GST included. We email you the report when it's ready.
What if you can't sign in?
We tell you why so you can fix it and try again, up to three times. If we still can't get in, you get a full refund automatically.
Check your Bolt app before real users arrive.
Free from the outside. ₹299 and ₹999 checks behind the login when you're ready.