AppLeakWatch
Security scanner for Bolt apps
Bolt turns a prompt into a deployed app in minutes, and a fast build rarely includes a security review. AppLeakWatch reviews what your deployed Bolt app actually exposes.
What usually goes wrong
API keys in client code
AI-generated front ends sometimes call paid APIs directly from the browser, which hands your key to every visitor.
Open database access
If your app uses Supabase or Firebase, missing rules can leave customer data readable.
Settings marked as public
Variables starting with VITE_ are built into browser code, so they can't hold secrets.
What else we check
- API keys for Stripe, OpenAI, Anthropic, AWS and others in your public code
- Downloadable .env, .git and database backup files
- API addresses that return data without a login
- SPF and DMARC records that stop people faking your email
- HTTPS redirects, certificates and browser security headers
How it works
Add your domain, prove you own it with one small change, and get a report with a letter grade and every check we ran. Scans only read public addresses and never change anything. No scan can prove an app is secure, but it can find the mistakes strangers look for first.
More scanners
- Security scanner for Lovable apps
- Security scanner for apps built with Cursor
- Security scanner for Replit apps
- Security scanner for apps built with v0
- Security scanner for apps built with Windsurf
- Security scanner for Base44 apps
- Supabase RLS checker
- Firebase security rules checker
- Exposed API key scanner