Full Scan, $49 per app

Security scan for apps built with Bolt

Bolt gets an app from idea to deployed in an afternoon. If your Bolt project uses Supabase for its data and lives in a GitHub repository, LeakScan can check it end to end and hand you prompts to fix what it finds.

What LeakScan checks in a Bolt app

All seven checks run in parallel: secrets in the code and its history, secrets in the live bundle, Supabase row-level security and policies, an anonymous read probe, a passive web scan, headers and certificate, and known vulnerabilities in your packages.

Where Bolt apps tend to leak

Apps generated quickly often put keys in client-side environment variables, deploy without security headers, and create tables before anyone thinks about who should read them. Each of those shows up in the report with its severity and a fix.

Before you scan

LeakScan supports apps with a Supabase backend and code on GitHub, served from a domain you control. Firebase, Neon, Replit-hosted apps and Bitbucket are not supported yet.

Common questions

My Bolt app has no GitHub repo yet. Can I still scan it?

Push the project to GitHub first. The code checks need a repository to read; the rest of the scan reads your live app and Supabase project.

Scan your Bolt app.

Paste its address to start. Read-only, one price, a report with a fix prompt for every finding.