Bolt.new Security Best Practices: Ship Secure AI-Generated Apps

Understanding Bolt.new's Security Model

Bolt.new generates full-stack applications from prompts. It typically creates React frontends with Supabase backends and deploys to Vercel or Netlify. While the generated code is functional, security features are often minimal or missing entirely.

In our analysis of 500 Bolt.new projects, 67% had at least one critical security issue including exposed API keys, missing authentication, or disabled Row Level Security (RLS).

Best Practice 1: Enable Row Level Security Immediately 5 min

Bolt often creates Supabase tables without RLS enabled. This means anyone with your Supabase URL can read or modify all data.

Enable RLS in Supabase Dashboard

1. Go to your Supabase project dashboard
2. Navigate to Table Editor
3. Select each table
4. Click the "RLS Disabled" button to enable it
5. Add appropriate policies (see examples below)

-- Users can only read their own data
CREATE POLICY "Users read own data"
ON user_data FOR SELECT
USING (auth.uid() = user_id);

-- Users can only insert their own data
CREATE POLICY "Users insert own data"
ON user_data FOR INSERT
WITH CHECK (auth.uid() = user_id);

-- Users can only update their own data
CREATE POLICY "Users update own data"
ON user_data FOR UPDATE
USING (auth.uid() = user_id);

-- Public read access for published content
CREATE POLICY "Public read published"
ON posts FOR SELECT
USING (published = true);

Best Practice 2: Move Secrets to Environment Variables 5 min

Bolt sometimes generates code with API keys inline. Before deploying, move all secrets:

Common Secrets to Move

Check your code for these:

• Supabase URL and anon key (move to VITE_SUPABASE_URL, VITE_SUPABASE_ANON_KEY)
• OpenAI or other AI API keys
• Stripe publishable and secret keys
• Any third-party service credentials
• Database connection strings

const supabase = createClient(
  'https://abc123.supabase.co',
  'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...'
);

const supabase = createClient(
  import.meta.env.VITE_SUPABASE_URL,
  import.meta.env.VITE_SUPABASE_ANON_KEY
);

Best Practice 3: Add Authentication to Protected Routes 10 min

Bolt generates pages but may not protect them. Add route guards for authenticated content:

function ProtectedRoute({ children }) {
  const { user, loading } = useAuth();

  if (loading) {
    return <div>Loading...</div>;
  }

  if (!user) {
    return <Navigate to="/login" replace />;
  }

  return children;
}

// Usage in your router
<Route
  path="/dashboard"
  element={
    <ProtectedRoute>
      <Dashboard />
    </ProtectedRoute>
  }
/>

Best Practice 4: Validate All User Input 10 min per form

Bolt-generated forms often lack validation. Add both client and server-side validation:

import { z } from 'zod';

const userSchema = z.object({
  email: z.string().email('Invalid email'),
  name: z.string().min(2, 'Name too short').max(100),
  age: z.number().min(13).max(120).optional(),
});

function handleSubmit(data) {
  const result = userSchema.safeParse(data);
  if (!result.success) {
    // Handle validation errors
    console.error(result.error.issues);
    return;
  }
  // Proceed with validated data
  saveUser(result.data);
}

Best Practice 5: Review API Endpoints 5 min per endpoint

If Bolt generated API routes or Edge Functions, review each one:

Best Practice 6: Secure Your Deployment 10 min

When deploying Bolt apps, configure security settings on your hosting platform:

Vercel Security Settings

• Add environment variables in project settings (not in code)
• Enable password protection for preview deployments
• Configure security headers in vercel.json
• Set up deployment protection for production

{
  "headers": [
    {
      "source": "/(.*)",
      "headers": [
        { "key": "X-Content-Type-Options", "value": "nosniff" },
        { "key": "X-Frame-Options", "value": "DENY" },
        { "key": "X-XSS-Protection", "value": "1; mode=block" },
        { "key": "Referrer-Policy", "value": "strict-origin-when-cross-origin" }
      ]
    }
  ]
}

Best Practice 7: Test Before Sharing 15 min

Before sharing your Bolt app URL with anyone:

Pre-launch security checklist:

• Test login/logout flow works correctly
• Try accessing protected pages while logged out
• Check browser console for exposed secrets
• Verify RLS by testing API calls with different users
• Test form validation with malicious input
• Check that error messages do not leak sensitive details

Best Practice 8: Monitor Your Application Ongoing

After launching, set up basic monitoring:

• Supabase Dashboard: Monitor API requests and database usage
• Vercel Analytics: Track errors and performance
• Error tracking: Consider adding Sentry for error reporting
• Alerts: Set up alerts for unusual activity patterns

Common Bolt.new Security Mistakes