Lock down the data
Real row-level security written and tested per table, so a table is readable only by the people who should read it, the single most-skipped step in vibe-coded apps.
Vibe coding rescue · Bolt.new
Is your Bolt.new app safe to launch?
Usually not without a review. The most common holes in a Bolt.new app are missing row-level security (your database readable by anyone), API keys shipped in the frontend, permission checks that run in the browser where they can be bypassed, and no rate limiting. None of these show up in a demo; all of them show up after launch. A 48-hour audit tells you exactly which you have.
AI builders optimise for a working demo, not a hostile internet. The code compiles and the happy path works, so it feels done, but the security decisions that separate a demo from a product were never made. That gap is invisible right up until the day someone curious reads your whole database or lifts a key from your frontend bundle.
Our audit is the adversarial review the tool cannot do on itself. We check data access table by table, hunt for secrets in the client, verify that permissions are enforced on the server and not just the UI, and pressure-test the auth and payment flows. You get a prioritised list of what is dangerous and one fixed price to close it before you launch, not after.
How we fix it.
Get secrets out of the client
Every API and service key shipped to the browser gets moved server-side and rotated. One lifted key is someone else running up your bill or reading your data.
Enforce permissions where they count
Access checks move from the UI (where anyone can bypass them) to the API, and public endpoints get rate limiting and input validation.
Specific to Bolt.new
What usually needs attention in Bolt.new apps.
Stuck on the preview URL
The app lives at a Bolt preview link with no custom domain, no SSL story, no staging, and no way to deploy a fix without regenerating half the project.
Demo-grade auth
Auth flows that pass the happy path but skip verification, session expiry, and permission checks enforced on the API itself rather than only in the UI.
One deploy, no safety net
No error tracking, no backups, no rollbacks. The first bad deploy after launch takes the app down with no way back but another prompt.
How a rescue works.
Fixed price, milestone payments, and a written audit before you commit to anything.
Audit, 48 hours
Send repo or tool access. You get a plain-language report of what is solid, what is dangerous, what is unfinished, and a fixed price for the rest.
Fix and harden
Security first: auth, data access, secrets, rate limits, payments. The invisible work that keeps your launch out of the news for the wrong reason.
Finish and launch
The stalled features get built, the deploy pipeline gets set up, and the app goes live on your domain with monitoring, alerts, and daily backups.
Stay if you want
Every rescue includes 30 days of fixes. Many founders keep us on afterwards for the roadmap, through Resident™, our monthly retainer.
Questions
What are the most common security holes in a Bolt.new app?
Four, in order: row-level security never turned on (the database is readable by anyone), API or service keys shipped in the frontend bundle, permission checks that run only in the browser, and no rate limiting on public endpoints. The audit tells you which of these your Bolt.new app has.
My Bolt.new app may have already leaked data. What do I do?
Treat it as an incident. We rotate exposed keys, lock down the affected tables, and assess what was reachable before anything else, then do the normal hardening pass. Book a call and flag it as urgent so we move the audit to the front of the queue.
Can you just do the audit without the full fix?
Yes. The 48-hour audit is a standalone deliverable: a prioritised, plain-language report of what is dangerous, what is missing, and a fixed price to close each item. Many founders take the report and decide from there; there is no obligation to continue.
Send us your Bolt.new project.
Book a 30-minute call with a founder. Within 48 hours of access you will know what is solid, what is dangerous, and what it costs to launch.
