How to secure an app built with Bolt.new

What Bolt generates

Bolt typically produces a Vite and React single-page app, often with Supabase for data and auth. Everything Vite builds, including any variable prefixed VITE_, ends up in JavaScript that every visitor downloads.

That means the security of the app lives in two places you cannot see in the preview: the database rules and whatever server code you add. If there is no server code, there is nothing to stop a visitor calling your database or AI provider directly.

The checklist

1. Search the project for VITE_ variables and confirm none of them hold a secret key.
2. Move calls that need a secret (payments, AI, email, admin) into Supabase Edge Functions or an API route, and call those from the browser instead.
3. Turn on row level security for every Supabase table and test it with only the anon key.
4. Enforce plan limits and roles in the server code or RLS policies, not by hiding buttons.
5. Make sure the published site serves a real 404 page and does not expose source maps or .env files.
6. Add a privacy policy and terms before collecting emails or payments.
7. Scan the published URL and fix critical and high findings before you share it.

Questions

Are VITE_ environment variables secret?

No. Vite replaces them in the client bundle at build time, so any visitor can read them.

Do I need a backend for a Bolt app?

You need server-side code for anything that uses a secret key or must be enforced, such as payments, AI calls with your key, and admin actions. Supabase Edge Functions are a common choice.

Related Defexity checks

• SEC-016: Secret key exposed in public HTML or JavaScript
• SEC-015: JavaScript source maps are public
• SEC-012: Environment file publicly accessible
• REL-002: Missing custom 404 page
• PRV-001: No privacy policy link

Sources

• Vite docs: env variables and modes (opens in a new tab)