Prodable’s free scanner runs about 48 look-only checks on your live Bolt.new app — leaked secret keys, a database anyone can read, missing safety settings, and doors left open to other sites. No signup, results in about a minute. It works on any live URL, whether your Bolt app uses Supabase or not.
Paste your Bolt.new URL or custom domain — the scan works on any live app.
There isn’t a named Bolt.new incident on record, so we won’t invent one. What is documented is the category: Veracode found that 45% of AI-generated code fails security tests, Wiz Research put roughly 1 in 5 vibe-coded apps as containing security risks, and Escape.tech found 2,000+ high-impact vulnerabilities and 400+ exposed secrets across 5,600 AI-built apps. Those are facts about the population of AI-built apps, not a claim about your app — the only way to know about yours is to test it.
Bolt apps commonly wire the frontend straight to Supabase, which means they inherit the same default exposures as any Supabase-backed build: tables reachable with the anon key, keys bundled into the client, headers left at their defaults. Supabase’s RLS-by-default is a good starting point, but a default describes intent — it doesn’t tell you what actually shipped once you added tables, integrations, and custom code.
Prodable tests your live site the way a stranger would — checking whether your data is readable, whether master keys leaked, whether hidden code is exposed. A chatbot can’t do this; it only sees your chat history, not the app that actually shipped.
Prodable checks the app that actually shipped, from the outside — independent of Bolt, Supabase, or whatever you built it with.
Leaked keys and passwords
We read the code your Bolt app ships to the browser, rebuild any hidden code left exposed, and find leaked keys (Stripe, OpenAI, Supabase), password files, and hidden project files.
Can the public read or change your data
If your Bolt app uses Supabase, we actually try to read your data — and make a safe test write — as an anonymous stranger, and report only what really came back, not what your settings claim.
Open doors and weak settings
We check for missing browser protections, whether other websites can act as your logged-in users, and email settings that stop scammers spoofing your domain (SPF, DMARC) — basics AI-built sites almost never set up.
We run about 48 safe, look-only checks on your live site and give you a grade from A+ to F. We only read what's already public — we never log in, change, or delete anything.
Test it to find out. Veracode found 45% of AI-generated code fails security tests and Wiz put roughly 1 in 5 vibe-coded apps as containing security risks, but those are population statistics, not a verdict on your app. Prodable's free scan runs ~48 read-only checks against your live Bolt URL and returns an A+ to F grade with the specific findings.
It depends on how the app was built. Any key placed in client-side code ships in the browser bundle where anyone can read it — this is a common pattern in AI-built apps, not unique to Bolt. Prodable fetches your bundle, recovers source from leaked source maps, and reports any exposed Stripe, OpenAI, or Supabase service-role keys it finds.
Yes — you should verify it. Supabase ships RLS-on-by-default, but as you add tables and features the effective access controls can drift, and a default is not proof of what shipped. Prodable performs a real anonymous read and write against your tables and tells you which, if any, are open to the public.
Yes. The scan is strictly non-destructive — read-only probes of your public URL. It never writes real data, authenticates, or attempts anything destructive; the only active check is a guarded empty-body insert used to confirm a table is genuinely writable.
Free, no signup, results in about a minute. You see your full grade with no email — the scan is free because fixing what it finds is where we come in.