Bolt.new security scan
Bolt.new can build and deploy a full-stack app from a prompt. Before real users sign up, check the basics that generated apps commonly miss. RowLocked runs those checks for free from the outside, the way a visitor would see your app.
What the scan checks
- HTTPS and response time
- Common security headers
- Public paths like /.env, /.git/HEAD and /admin (status only)
- Secret-shaped strings in your JavaScript bundles, masked in the report
- Supabase tables readable with the anon key, using row counts only
- Firebase public-read checks when a Firebase config is present
What it does not do
- No password guessing or login attempts
- No exploit payloads or port scans
- No storing of full secrets or database rows
After the scan
Each critical finding comes with a plain-English explanation and a prompt you can paste back into Bolt to fix it. Because every new prompt can change your app, the paid plans re-run the scan weekly and email you when something changes.
Questions
Do I need an account?
No. Paste your URL on the home page. Only scan apps you own or have permission to test.