Reeve Is your Bolt app safe?
Bolt lets you describe an app and watch it get built and deployed in minutes. It's genuinely impressive — but a fast build can quietly ship a setting or a key it shouldn't, and from inside the editor you'd never see it.
Reeve checks the most common problems from the outside, for free, and explains anything it finds in plain English. No install, no access to your accounts — we only look at what's already public.
Paste your app's link. About 20 seconds. See your grade with no signup.
What can actually go wrong with a Bolt app
None of these mean you did anything wrong — they're the usual side-effects of building fast. Here's what's worth checking:
A secret key ending up in the browser (the VITE_ trap)
Bolt apps are usually built with Vite, which has one rule that catches people out: any setting whose name starts with VITE_ gets baked into the code that runs in your visitor's browser — where anyone can read it. Name a real secret VITE_SOMETHING and it ships to the public. Some keys are meant to be public (like a Supabase "anon" key), which is fine — Reeve tells the safe ones from the dangerous ones, so no false alarms.
Your database left open (Supabase RLS off)
Bolt often wires your app to Supabase for data. Supabase has a switch called Row Level Security (RLS) that decides who can read or change each row. If it's off, your tables can be readable — or editable — by anyone who finds the address. It's the most common serious issue in AI-built apps, and it's invisible unless you check.
An exposed .env or config file
The .env file holds a project's keys and passwords. Sometimes it gets published alongside the deployed app by accident. If it's reachable from the outside, it's a shortcut to everything sensitive. Reeve checks whether yours is quietly accessible.
Public file storage
If people upload files to your app, those live in storage "buckets." A bucket left public means anyone can list or download what's inside — so a private upload can end up visible to everyone. Reeve checks whether your buckets are listable; it never downloads anyone's files.
Source maps left on
A "source map" is a helper file that reveals your app's original code. Handy while building, but if it ships to production it hands strangers a readable map of how your app works — making every other door easier to find. Low urgency, but worth tidying.
Missing safety headers & open endpoints
Small settings that tell browsers how to protect your visitors, plus whether your data endpoints answer to anyone or any website. Minor alone; together they widen the gap. Reeve flags the ones that are missing.
What Reeve is — and isn't
Reeve is a free, read-only check from the outside — like an inspector walking the perimeter and trying the doors. It's fast and catches the common, high-impact mistakes. It is not a full security audit, and a clean grade isn't a guarantee — it means the obvious doors are shut.
Bolt and StackBlitz keep improving what gets generated, and if your app uses Supabase, Supabase's own advisor flags database problems inside its dashboard. Both help. What Reeve adds: you live in Bolt, not in a dashboard, and those tools speak developer. Reeve looks at your whole deployed app from the outside — the way a stranger would — and tells you what it finds in words you can act on. And if you'd rather not think about it, we can watch it for you.
Want it handled, not just checked?
Reeve Care keeps watching your app, backs up your data, and helps you fix things when they break — so you can keep building instead of worrying.
Learn about Reeve CareQuestions, answered honestly
Is my Bolt app secure by default?
Bolt gives you a working app fast, but "secure by default" depends on how it's wired — especially your environment variables and, if you use Supabase, your database rules. The only way to know is to check what's actually exposed, which Reeve does free in about 20 seconds.
Why did my API key leak in a Bolt app?
Usually because it was stored in a setting starting with VITE_. Vite inlines those into the browser bundle on purpose, so any secret named that way becomes public. Reeve reads your app's loaded code, finds keys, and tells you which are safe to expose and which need to move to the server.
Does Bolt use Supabase, and is that safe?
Bolt frequently connects apps to Supabase. Supabase is safe when Row Level Security is on and only your public "anon" key is in the frontend. If RLS is off or a "service_role" key leaked, your data can be exposed. Reeve checks both without ever reading your actual data.
Will scanning my Bolt app change anything?
No. Reeve only looks at what's already public from the outside. It never logs in, never changes anything, and never downloads your files — read-only, like checking whether a door is locked without stepping inside.
Built somewhere else? We've got the same honest rundown for:
Automated external check, not a full audit. Absence of findings is not a guarantee of safety.