Bolt.new app security checklist before you launch

Updated 2026-10-14 · Defensive guide for your own app

Short answer

Before you share a Bolt.new app, check six things: no secret keys in the frontend bundle, RLS enabled with owner-scoped policies on every exposed table, explicit grants (especially after Supabase's Oct 30, 2026 change), no privileged functions callable by anonymous users, storage buckets and Firebase rules that aren't open, and every API route checking who the caller is. Many Bolt apps are Vite-based, so any VITE_ variable ends up in the browser.

The checklist

Secrets. No service_role/sb_secret_, Stripe secret, or AI provider keys in client code or in VITE_ variables. Rotate anything that was shipped. Guide
RLS on. Security Advisor shows no "RLS Disabled in Public" errors. Guide
Policies scoped. No write policies with using (true) or with check (true); reads use (select auth.uid()) = user_id unless the data is meant to be public.
Grants. anon only has select on public data. New tables ship with explicit grants. Guide
Functions. No SECURITY DEFINER function in public executable by anon. Guide
Storage. Public buckets have no broad listing policy; uploads and deletes are limited to the owner's path.
Firebase (if used). No if true rules. Guide
API routes and Edge Functions. Each verifies the user and their permission before doing work. Guide

Quick SQL audit for Supabase

-- Tables without RLS
select tablename from pg_tables where schemaname='public' and not rowsecurity;

-- Policies that allow everything
select tablename, policyname, cmd, roles, qual, with_check
from pg_policies
where schemaname='public' and (qual = 'true' or with_check = 'true');

-- Privileged functions anon can call
select p.proname from pg_proc p join pg_namespace n on n.oid=p.pronamespace
where n.nspname='public' and p.prosecdef
  and has_function_privilege('anon', p.oid, 'execute');

Why bother

In our own review of 30 public Lovable and Bolt repos built on Supabase, 33% had at least one critical or high-severity issue (small sample, directional only).

Check your own project in seconds

Upload a .zip of your own Lovable, Bolt, Cursor, Supabase or Firebase project. ProdCanary reviews the code statically and shows your top 3 risks with plain-English fixes. Your upload is deleted right after the scan.

Run a free scan

FAQ

Does Bolt secure my Supabase database for me?

Don't assume it. Check Supabase's Security Advisor and the queries above yourself before launch.

Is a using (true) read policy always wrong?

No. It's fine for data that is meant to be public, like a product list. It's wrong on user data or on any write policy.

How often should I re-check?

After every significant AI-generated change to the schema, auth or API, since new tables and functions can arrive without grants or policies you'd expect.

Sources

This guide is for securing apps you own or are authorised to work on. Facts above are from the official docs linked; check them for changes.