Security checks for apps built with Bolt
Bolt is great at turning an idea into an app. VibeSitter watches the parts that are easy to miss after the demo: public secrets, permissive CORS, missing headers, and Supabase policies that leave data readable.
What you get
- ✓Free surface scan from any public Bolt app URL.
- ✓Clear severity and evidence for every finding.
- ✓Fixes written for both humans and AI coding tools.
- ✓Optional read-only Supabase monitoring for regressions.
Checks that matter here
Client-side secret exposure
Looks for private keys or tokens that should never be in a browser bundle.
Open CORS
Flags wildcard or overly broad cross-origin policies on public endpoints.
Transport and browser hardening
Checks HTTPS, HSTS, frame protection, and content-type protections.
Supabase auth configuration
Connected checks review signup, email confirmation, and password policy settings.
Run a free check
Public URL only. No keys, no signup, no credit card.
Want database-level checks? See exactly what we access.
Common questions
Can I scan a Bolt preview URL?
Yes, as long as it is publicly reachable over HTTPS. Private or password-protected previews cannot be scanned.
Will this change my app?
No. Free scans are read-only HTTP requests. Connected checks use read-only OAuth scopes and never modify your project.