Is Bolt.new Secure? Security Risks in Bolt-Built Apps
Bolt.new (by StackBlitz) lets founders build and deploy full-stack apps in the browser with AI. It is fast, impressive, and generates working apps quickly. Like all vibe coding tools, the apps it generates have a consistent set of security patterns that need expert review before real users and real data are involved.
What Bolt Generates
Bolt generates full-stack applications — typically a React or Next.js frontend with a Node.js or Express backend, sometimes using SQLite or a connected cloud database. The generated code is functional and demo-ready quickly. The gap between demo-ready and production-ready is where security issues accumulate.
Hardcoded Secrets in Source Code
Bolt apps frequently have API keys, database connection strings, and service credentials hardcoded in source files — particularly in the initial scaffold when the AI sets up integrations. These end up in GitHub repositories, sometimes public ones. Rotate any key that has ever been in a Bolt-generated codebase and move all secrets to environment variables immediately.
Missing Authentication on API Routes
Bolt-generated backends often have authentication on some routes and not others — particularly data fetching endpoints that were added iteratively. Each new feature the AI adds may or may not include the authentication middleware from the previous features. The result: some endpoints are protected and others are not, with no obvious pattern. A full endpoint audit is required to find the gaps.
No Rate Limiting
Bolt-generated APIs ship without rate limiting on any endpoint by default. Login endpoints, password reset, account creation, and any endpoint that sends emails or makes external calls are all open to abuse. This is a consistent gap across all Bolt-generated backends.
SQLite in Production
Bolt frequently uses SQLite as the default database because it requires no external setup. SQLite is fine for development and very small apps, but it has no concurrent write handling, no native connection pooling, and no point-in-time backups. Any Bolt app expecting real traffic needs to migrate to Postgres or MySQL before launch.
How to Audit a Bolt App
Start with: secret scanning (codebase and git history), a full endpoint authentication audit, IDOR testing with two test accounts, and a database review (schema, query parameterization, access controls). For apps beyond prototype scale, add performance and infrastructure review. A professional code audit of a Bolt app takes 2–4 days and delivers a prioritized fix list with specific file and line references.