Keep secrets in server functions
Anything shipped in browser code can be inspected. Put private API keys and privileged database access in Bolt Secrets for server functions, then rotate any value that reached the frontend.
Bolt app security checklist
Check what actually went live.
Bolt checks for vulnerabilities when you publish. LaunchGlint adds a separate GET-only look at the exact public URL, where stale releases, browser-visible values, indexing mistakes, and missing buyer-trust paths can still show up.
Public secrets
Live release
Noindex
Source maps
Trust pages
Six checks before sharing the link
Preview the deep reportUpdate the production release
Bolt project edits do not automatically change the published site. Use Publish or Update, then open the public URL in a fresh browser session and confirm the expected release is live.
Review database access as two users
Test that one account cannot read or modify another account's records. Keep service-role or privileged database keys out of client bundles and enforce authorization server-side.
Check public visibility and indexing
Public Bolt sites can be discovered by search engines. Verify intentional visibility, remove accidental noindex before launch, and keep unfinished or sensitive projects private.
Inspect the exact buyer-facing domain
Test HTTPS, redirects, canonical metadata, social cards, security headers, public source map references, and debug leftovers on the final domain rather than only inside preview.
Make payment and support credible
Before charging, show pricing, delivery expectations, support, privacy, terms, and refund language on the same domain buyers are evaluating.
Bolt fix prompt
Give the builder a bounded repair task.
Pre-launch production review prompt
Review this Bolt project for production launch. 1. Find private or privileged values reachable from browser code. 2. Move sensitive calls into server functions backed by Bolt Secrets. 3. Verify database authorization with a two-user isolation test. 4. Remove debug artifacts and unnecessary public source maps. 5. Verify indexing, redirects, security headers, support, privacy, terms, and refunds. Publish the update, then list exact checks to run against the public URL.