AI App Launch Audit · Fixed price, quoted up front
Bolt App Security Audit
Bolt.new can take you from a prompt to a deployed app in an afternoon. Before you send real customers to it, our senior Brisbane-led team checks what an automated audit can’t promise: that your database rules, server functions, secrets and sign-in flows actually hold up when someone goes looking.
Fixed price, quoted up front
Free 30-minute engineer chat
Bolt Database and Supabase rules tested
Built JavaScript searched for leaked keys
Senior human review, not another scan
We fix it, then check again
Where the risks are
Where Bolt apps go wrong before launch
Bolt projects run on Bolt Cloud, which uses Netlify for hosting and Supabase for databases, or on your own connected Supabase and Netlify accounts. The building blocks are sound. The risks come from how fast they get wired together.
Backends
Two possible databases, two sets of settings
New projects use Bolt Database by default, but many connect their own Supabase project instead. Both run on the Supabase stack, yet where settings live, and which ones you can change, differs. We start by confirming exactly which database, auth and hosting your app uses.
Database access
Policies that let everyone in
Bolt’s database security check warns when a policy is “always true”. That’s fine for genuinely public data, but it’s often left over from getting a feature working. We check every table’s rules against who should really see each row.
Client-side secrets
Keys baked into the browser bundle
Most Bolt apps are Vite projects, and any environment variable starting with VITE_ is compiled into the JavaScript every visitor downloads. Payment, email and AI keys belong in server functions and secrets. We search your built app, not just the source.
Server functions
Functions that trust the caller
Server functions hold your secrets and talk to your database with elevated access. If one doesn’t check who is signed in, or accepts any input it’s given, it becomes a public door. We review each one’s auth, validation and rate limits.
Code quality
Code that’s hard to change safely
Fast iteration leaves duplicated logic, dead code and components that each talk to the database their own way. That isn’t a hole on day one, but it’s how the next prompt introduces one. We flag what to tidy before you scale.
Hosting
Preview and production mixed up
On Bolt hosting, Netlify or your own pipeline, we check your custom domain, HTTPS, security headers and which database each deployment points at, so test data and preview links never touch production.
Built-in audit vs ours
Bolt’s security audit is a great start. Here’s what a human audit adds.
Bolt’s security audit, in the Publish menu, reviews your code and database across six areas and fixes most of what it finds. A lighter database check is available on every plan. Run them every time you publish. They don’t claim to make your app fully secure, though, and they can’t judge whether your rules match your business.
Built in
Bolt’s security audit and database check
Automated checks inside Bolt. Run them, and act on what they find, before you book anything.
- Six areas: data access, public exposure, sign-in, misuse, visitor input, and keys and settings
- Fixes most issues itself, and lists the rest under “Needs your action”
- Database check using the same rules as Supabase’s Security Advisor
- Rolling back to an earlier version also rolls back its fixes
Human review
AI App Launch Audit
Senior engineers test your app the way an attacker, and a real customer, would.
- Every policy and function checked against your real roles and data
- Live testing with the public key and each user role
- Your built JavaScript searched for keys, tokens and debug settings
- Code quality, performance and error handling reviewed
- Plain-English report, fixes or fix prompts, and a re-test
New to this? Start with our pre-launch checklist for vibe-coded apps, or read about the AI App Launch Audit for every platform.
Checklist
Bolt pre-launch security checklist
Work through these before you share your Bolt app with real customers. If any answer is “not sure”, that’s what the audit is for.
Database and backend
- You know whether your app uses Bolt Database or your own Supabase project, and who has admin access to it
- Row level security is on for every table, and the database Security tab shows no errors
- Any “RLS Policy Always True” warning is on a table that’s genuinely public
- Users can only read and change their own records (test it with two accounts)
- Server functions check the signed-in user before touching private data
- Storage for private uploads isn’t publicly readable
Code, secrets and launch
- No secret key uses the
VITE_prefix or appears in your built JavaScript - Payment, email and AI API calls happen in server functions, not the browser
- Admin screens are protected on the server, not just hidden
- Email confirmation and leaked password protection are switched on
- Your custom domain uses HTTPS and sensible security headers
- You’ve run Bolt’s security audit and cleared the “Needs your action” items
Want the reasoning behind each item? Our vibe-coded app checklist explains the risks in plain English.
How it works
How a Bolt app audit works
You don’t need to share your Bolt login. Bolt projects can be connected to GitHub or downloaded, which gives us everything we need to review the code.
01
Share and scope
Connect your project to GitHub or send us a download, plus a link to the app and a test account for each user role. We agree the scope and confirm the fixed price.
02
Probe the live app
We test the deployed app with the public database key and each role, check every table and function, and inspect what your built JavaScript gives away.
03
Review the codebase
We look at structure, error handling and performance on realistic data, and flag the patterns that make the next round of prompts risky.
04
Report, fix and re-test
You get a plain-English report ranked by severity. We fix the issues, or give you prompts to fix them in Bolt yourself, then re-test before launch.
Pricing
What a Bolt app audit costs
Fixed price, agreed in writing before we start. No hourly billing and no surprise invoices.
Free consultation
Start here
$0
30 minutes with an engineer
Tell us what you’ve built in Bolt, who will use it and what data it holds. We’ll tell you honestly whether it needs an audit yet.
- No pitch, no obligation
- Mutual NDA on request
- A clear next step either way
Fixed price
AI App Launch Audit
Scoped to your app
Quoted
fixed price, agreed before we start
A senior review of your Bolt app’s security, data access, code quality and launch readiness.
- Every database rule, function and secret reviewed
- Live testing with real user roles
- Plain-English report ranked by severity
- Re-test after fixes
Fixes and launch support
After the audit
Quoted
based on the audit findings
We fix what the audit finds, or coach you through fixing it with your own prompts, then help you launch.
- Quoted against the findings
- You choose what we fix
- Help with hosting and go-live
All prices in AUD. The audit price depends on the size of your app and is confirmed before any work starts. Still building and want ongoing help instead? See the AI Build Partner, a separate monthly product.
FAQ
Bolt app audit questions
I’ve run Bolt’s security audit. What would a human audit find that it doesn’t?
Mostly problems that depend on your business: which users should see which records, what happens when someone skips a step or edits a price, and whether your rules match how your team actually works. We also test the live app with real roles and review code quality and performance, which an automated pass can’t judge.
Is my Bolt app’s public database key a problem?
Not on its own. The public (anon) key is meant to be in the browser, and your row level security decides what it can reach. It’s a problem when those rules are missing or too generous, or when a secret key ends up in the bundle beside it.
Does it matter whether I use Bolt Database or Supabase?
The risks are the same, because both run on the Supabase stack. What changes is where settings live and what you control directly, so we confirm your setup first and tailor the review.
Can you audit a Bolt app hosted on Netlify?
Yes. We audit Bolt apps wherever they’re hosted: Bolt hosting, Netlify or your own pipeline. Hosting settings such as domains, HTTPS and security headers are part of the review.
Do you need my Bolt login?
No. GitHub access or a project download, your app’s URL and test accounts are enough to start. If we need read-only database access, we’ll ask for exactly that.
Will you rebuild my app?
No. The goal is to make what you’ve built safe to launch. We fix issues in place, or give you prompts to fix them in Bolt yourself. A rebuild only comes up if you ask for it.
How much does a Bolt app audit cost?
It’s a fixed price, quoted for the size of your app and agreed before we start. Not sure if you need one yet? Book the free 30-minute chat.
Can you keep an eye on the app after launch?
Yes, through a separate product. If you're still prompting new features into your app with Bolt, our AI Build Partner puts an engineer across it on a steady rhythm: they review what changed, build and fix alongside you, and release it to production monthly or fortnightly. Plans start at $1,800 a month ex. GST, with a three-month initial term and then month to month. The audit fee isn't credited against a plan; they're separate products for different needs.
Built with something else?
AI App Launch Audits for every platform
The risks differ from tool to tool, so each audit starts with how your platform really works.
Launch your Bolt app with confidence.
Book a free 30-minute chat with an engineer. Bring your app link and what it does, and we’ll tell you honestly what it needs before real customers arrive.
