How to Deploy Bolt.new Securely in 2026

Audit your environment variables for VITE_ exposure

Open your Bolt project's .env file or check Netlify's environment variable panel. Any variable starting with VITE_ is a client-side variable. In Vite, that prefix is how you explicitly opt into browser exposure.

For a Bolt app, the dangerous ones are:

• VITE_SUPABASE_SERVICE_ROLE_KEY (full database bypass)
• VITE_OPENAI_API_KEY (pays your OpenAI bill)
• VITE_STRIPE_SECRET_KEY (processes real payments)

The VITE_SUPABASE_URL and VITE_SUPABASE_ANON_KEY are intentionally public. The anon key is safe to ship client-side as long as your RLS policies are correct.

grep -r "VITE_" . --include="*.env" --include="*.ts" --include="*.tsx" --include="*.js" | grep -v "node_modules"

Any output that is not VITE_SUPABASE_URL or VITE_SUPABASE_ANON_KEY is a secret that needs to move server-side.

Enable Supabase RLS on every table

Go to your Supabase dashboard, open Table Editor, and click each table. Look for "Row Level Security" in the settings panel.

Turn it on for every table. Then add policies. The simplest policy for user data:

-- Users can only read their own rows
CREATE POLICY "Users read own data" ON your_table
  FOR SELECT USING (auth.uid() = user_id);

-- Users can only insert their own rows
CREATE POLICY "Users insert own data" ON your_table
  FOR INSERT WITH CHECK (auth.uid() = user_id);

If you have a table that should be publicly readable (like blog posts or product listings), make it an explicit policy rather than leaving the table open by default.

Move secret API calls into Netlify Functions

Any API call that uses a secret key belongs on the server. Netlify Functions run server-side and can access environment variables that the browser never sees.

Create a netlify/functions/ directory in your project root, then write a function that wraps your API call:

const OpenAI = require("openai");

exports.handler = async (event) => {
  const { prompt } = JSON.parse(event.body);
  const openai = new OpenAI({ apiKey: process.env.OPENAI_API_KEY });

  const response = await openai.chat.completions.create({
    model: "gpt-4o-mini",
    messages: [{ role: "user", content: prompt }],
  });

  return {
    statusCode: 200,
    body: JSON.stringify({ reply: response.choices[0].message.content }),
  };
};

Your frontend calls /.netlify/functions/ask-openai instead of the OpenAI API directly. The OPENAI_API_KEY environment variable (no VITE_ prefix) never leaves Netlify's servers.

Set environment variables in the Netlify dashboard correctly

In Netlify: Site Configuration > Environment variables > Add variable.

For each secret, enter it without the VITE_ prefix. Netlify stores these server-only by default. The build process can read them in Netlify Functions, but they don't appear in your client bundle.

Correct setup:

If you need a variable in both browser and server code, create two versions: one with the prefix (browser) and one without (server). Only do this for truly non-secret values.

Run a pre-launch security scan

Before you share the URL, scan the deployed app. CheckYourVibe checks your JavaScript bundle for exposed key patterns, tests your Supabase endpoints for open access, and reviews your HTTP response headers for missing security settings.

1. Open your deployed app
2. Press F12 → Sources tab
3. Search (Ctrl+F) for: sk_live_, sk_proj_, AKIA, eyJhbGci, service_role
4. Any hits are secrets in your bundle. Stop and fix before continuing.

After the scan, check these before sharing:

• No secret key patterns in bundle (scanner or manual check above)
• Supabase RLS enabled and tested (try accessing your data as an unauthenticated user)
• Response headers include X-Frame-Options, X-Content-Type-Options
• Authentication routes actually require login (test by going to a protected URL without being logged in)