SniffPupBolt app security scanner for your live site
Published an app with Bolt.new? Paste the live URL below. SniffPup checks what the published site shows anyone who visits it, passively and read-only.
This runs SniffPup's normal free scan, so you get the whole report, not just this one check. Results cover your whole published site: secret keys, public files, Supabase key exposure and security headers. The free report lists every issue it finds with its severity, plus the full fix free for every critical issue (with no critical, one other fix). Only scan sites you own or are authorized to test. What the scanner does and never does.
Start with Bolt's own checks
Bolt makes this easy. Its security docs say “we recommend running a security check at least once before you publish.” The project security audit (on paid plans) reviews your code and database, fixes most problems itself and lists anything you need to do by hand. The database security check is available on all plans, and running the audit from the Publish menu doesn't use tokens. Do this first.
SniffPup adds an outside view after you publish: it reads the live site the way a stranger's browser does and reports what it can actually see.
What this checks
- Secret keys in your JavaScript bundles, matched against known secret key formats, including keys that slipped into a
VITE_variable, and Supabaseservice_roleorsb_secret_keys. Any key found is masked in the report. - Public files such as
/.env,/.git/configand public source maps. - Supabase in the browser: whether your site talks to Supabase and whether the public anon key is present (normal, shown as information).
- Security headers, cookie flags and HTTPS on the page you enter, plus whether your HTTPS certificate is valid and when it expires.
- Outdated JavaScript libraries with known vulnerabilities (the free scan shows the worst one in full).
What it can't tell you
- It can't see your Bolt project, your code or your database rules. Bolt's audit and the Supabase RLS checker guide cover those.
- It doesn't log in, so pages behind sign-in aren't checked.
- It scans live web URLs only, not native mobile apps.
- A 100 score means no issues were found in our checks. It isn't proof of security.
More: Bolt app security check: is my Bolt app secure? A pre-launch checklist and the best free security scanners for vibe-coded apps.
Questions
Bolt has a security audit. Do I still need this?
Bolt's project security audit reviews your code and database and fixes what it can, and Bolt recommends running a security check at least once before you publish. Do that first. SniffPup adds an outside view of the published site: what its JavaScript, public files and headers actually show visitors.
Why do VITE_ variables matter?
In a Vite app, any variable starting with VITE_ is bundled into the JavaScript every visitor downloads. A secret key in a VITE_ variable is public. SniffPup looks for secret key patterns in those bundles.
Does SniffPup need access to my Bolt project?
No. You only enter the live URL. SniffPup never logs in and never uses a secret key it finds.
Does a 100 score mean my Bolt app is secure?
No. A 100 means no issues were found in our checks. It isn't proof of security.
Can it scan a native mobile app?
No. SniffPup scans live web URLs only, not native iOS or Android apps.