What is the most common security mistake in Bolt.new apps?

Secrets ending up in the browser: real API keys written into VITE_-prefixed variables (which Vite bundles into public JavaScript) or .env files committed to git. Between 40% and 62% of AI-generated code contains vulnerabilities in independent tests, and exposed secrets are the most immediately exploitable kind - scans of vibe-coded apps have found hundreds of live keys.

Are VITE_ environment variables secret?

No. Anything prefixed VITE_ is compiled into the browser bundle and visible to every visitor - that's by design, for public configuration. Real secrets must live in server-side environment variables (e.g. Netlify env vars) and only be used inside serverless functions.

Do I need serverless functions for my Bolt app?

If your app calls a paid or private API (OpenAI, Stripe, a database admin operation), yes - the call must run server-side in a function that holds the key and checks who is asking. Calling paid APIs directly from the browser publishes your key and lets anyone spend on your account.

Bolt App Security Checklist

Your Bolt.new app runs - this checks whether it leaks. 19 platform-specific checks covering committed .env files, secrets bundled into browser code, unprotected serverless functions and database rules. Independent tests find 40-62% of AI-generated code contains vulnerabilities - tick these off before strangers find them.

By Carl Mills - cloud & security engineer • Last updated 9 July 2026 • Progress saves in your browser • free personalized PDF print-out.

0/0 items completed

0/100

Critical only

Import File

Your selections are saved in your browser. Export a personalized PDF print-out any time.

Bolt security FAQ

Are VITE_ variables secret?

No - they're compiled into public browser JavaScript by design. Real secrets belong in Netlify (or other host) env vars, used only inside serverless functions.

Bolt wrote my keys into the code. What now?

Move them to server-side env vars, then regenerate every key that ever appeared in code or a prompt - deleting the line doesn't delete the history.

What next once everything's ticked?

Run the general 12-point AI-app launch checklist, compare hosting costs, and push the code to your own GitHub.

Want a professional pass?

A fixed-scope security review covers every item here plus the ones only an engineer would find - with a prioritised fix list.

Get in touch