AI coding tools/Bolt
Not without a review pass. Bolt generates an entire application at once, so every security decision — where credentials live, whether the database enforces access rules, what the API exposes — was made by a model in a single pass. The most common findings are keys shipped to the browser and databases whose access rules were never configured.
Bolt is a browser-based tool that generates and runs full-stack applications. Bolt produces an entire working application from a prompt, which means the security decisions are made all at once, by the model, before anyone has read a line.
These are patterns we look for in code produced this way — not flaws in Bolt itself. Each names the check that finds it.
Generating a working app end to end means wiring the frontend to services directly. Anything bundled into client-side code is readable by every visitor via developer tools, whatever the variable is called. Service keys placed there are effectively published.
Detected by: Hardcoded API key or secret
Generated applications commonly connect to a hosted database that is secure only once row-level access rules are written. Until then the client credential can often read and write far more than the interface offers, and the app works perfectly while being fully open.
Detected by: Unvalidated request input
Building a UI quickly leads to injecting content into the DOM without escaping — a rendered description, a bio, a listing, a comment thread. Whatever one user types is then executed as markup in the next visitor's browser, which turns an ordinary text field into a way to run script inside someone else's authenticated session.
Detected by: innerHTML assignment
A one-pass generator creates the routes a feature needs, plus scaffolding routes it decided were useful, and nobody enumerates the result afterwards. Unlisted is not the same as unreachable: an endpoint absent from the interface still answers anyone who requests it, and unauthenticated routes are the first thing automated scanners probe for.
Detected by: Unvalidated request input
Every check named above runs automatically. Free on public repositories, no signup, results in under three minutes — with the file and line for each finding.
It can be, after a security pass. Bolt is a fast way to reach a working application; what it does not do is make the security decisions a production deployment needs. The gap is between working and safe, and closing it is a review task rather than a prompting task.
Whether any credential reaches the browser, and whether the database enforces its own access rules. Those two account for the most severe findings in generated applications, and both are invisible from the interface — the app behaves identically whether or not they are correct.
Partly. An automated scan will report exposed credentials and structural risks in plain language with the file and line for each. Judgements about whether your access rules match your business logic still need someone who understands the intended rules.