VibeAudit

For Bolt.new builders

Security audit for Bolt.new apps before you launch

Bolt builds full-stack apps in the browser and deploys them in minutes. The speed comes from letting the model decide where secrets go and which routes need auth, and those are exactly the two decisions that matter once the app is public.

VibeAudit reads the repository you push from Bolt and reports, with file and line, what an attacker or a curious user could do on day one.

Scan your Bolt.new app now — free, under a minute, no signup

Paste the GitHub repository URL. Public repos work as-is; sign in with GitHub for private ones.

Public repo URL, no signup. Private repo? Sign in with GitHub and pick it — read-only, nothing stored except the report.

What Bolt.new apps usually ship with

From our audits of real repositories. Every item below is something the deep audit reports with file and line, plus a fix prompt.

API keys in client code

Keys pasted into a component or a `VITE_`/`NEXT_PUBLIC_` variable ship to every browser. We see OpenAI, Stripe and Supabase keys most often.

Serverless functions that trust the request body

Prices, user ids and roles taken from the request instead of the session let anyone pay $0 or act as someone else.

No rate limiting on AI endpoints

An unauthenticated `/api/generate` is an open credit card for your model provider.

Debug and seed routes left enabled

Routes gated by `NODE_ENV` or nothing at all, which reset or expose data in production.

Read before you launch

  • Unbounded AI endpoints: paying for someone else's prompts · coming soon
  • Trusting the client: prices, roles and scores sent from the browser · coming soon
  • Secrets committed to the repo and hardcoded credentials · coming soon
  • API routes and server actions with no auth check · coming soon
  • Missing ownership checks (IDOR): reading and editing other users' data · coming soon
  • Supabase service-role and secret keys leaking to the browser · coming soon
  • Stripe webhooks, idempotency and billing logic bugs →

FAQ

My app is deployed from Bolt, not GitHub.
Use Bolt's Export or GitHub sync to get the code into a repository, then paste the URL. We need the source, not the deployed site.
Will it understand a Vite + Express app?
Yes. The audit is framework-agnostic; it reads routes, middleware, config and env handling in any JS/TS, Python, Go or Ruby project.
Also for:Lovablev0CursorReplitClaude CodePublic audits of popular starters →