Credit where it's due, because a lot of writing on this pretends the built-in tools are theatre. They aren't.
The auto-fix is the part that genuinely matters. For a non-technical builder, a list of twelve findings is not much use — the bottleneck was never detection, it was knowing what to do next. Bolt removing that step is worth more than a longer findings list would be.
A code scan reasons about what your app should do. It reads your policies, endpoints and dependencies as written. It does not check what your deployed app hands to a stranger.
That gap is where the real incidents live. Environment variables differ between preview and production. A database policy gets switched off while debugging at 1am and never switched back. A table is added after the last publish. A custom domain serves without HSTS. None of those are code defects, so a code scanner has no reason to report them — and every one is visible from outside in seconds.
This is not a criticism of Bolt specifically; it is why external audit exists as a profession. A platform reviewing its own output cannot see the assumption it is itself making. Across this category, the serious flaws have consistently been found by outside researchers rather than by the platforms' own tooling.
supabase.co. If you find a project URL and a long anon key, that key is public by design — so what protects your data is Row Level Security. Test it signed out, in a private window:
https://YOUR-PROJECT.supabase.co/rest/v1/users?select=*&apikey=YOUR_ANON_KEYAn empty list
[] or a permission error is correct. Real rows means anyone on the internet can read that table right now. Full walkthrough, including the write test almost nobody runs.service_role, sk_live_ and OPENAI_API_KEY. Bolt keeps secrets in server functions by default, which is the right architecture — but defaults get overridden, and a service_role key in the bundle bypasses every database policy you just checked.Or have all four run for you. Broid tests your live Bolt app from outside in seconds — free grade, no signup, including the database check.
Scan my app free →Every major AI builder now ships security scanning, so that is no longer what separates them. What separates them is architecture — specifically whether the app you ship puts the browser directly on the database. We compared all five in detail, including the study of 1,072 live AI-built apps where 98% had at least one flaw and 172 allowed a stranger to delete data without logging in.
Yes. Bolt's security agent has run on publish since October 2025, and a whole-project audit with automatic fixes was added in mid-2026. It covers access control, authentication, business logic, database policies, information disclosure, secrets and injection/XSS. It is free and does not consume your tokens.
For code-level problems, Bolt's agent does more than most — it applies the fixes rather than listing them. What it cannot do is test your deployed app the way a stranger meets it. A policy disabled during debugging, a table added after the last publish, or production environment variables that differ from preview are all invisible to a code scan and obvious from outside.
More so than some — Bolt keeps secrets in server functions rather than the browser bundle, which is the right default. But security depends on what your specific app does, and defaults get overridden as an app grows. The database check in step one is worth running regardless of platform.
The same as in every AI-built app that uses a browser-side database client: missing or misconfigured Row Level Security. The largest published scan of AI-built apps found unauthenticated data deletion and modification more often than unauthenticated reading — meaning far more apps protect reads than protect writes.
Nothing for a grade. Broid scans any URL free and returns an A–F security grade in seconds, including the live database-exposure test. A full report with plain-English explanations and a copy-paste fix prompt for each finding costs one credit, from $5 for five.
Yes, and you should know how. The four steps above need nothing but your browser. We publish the manual version of every check we run for exactly that reason.
Paste your URL and get an A–F grade in seconds, including the live database-exposure test.
Scan my app freeBroid is independent — we don't build apps, so we have no reason to tell you yours is fine.