Bolt: New Database Tables Private by Default
BoltBolt now keeps new database tables private by default starting October 30, so apps must be granted explicit permissions before they can read or write data. Existing databases are not affected. Bolt is expected to set up permissions when it creates a new database, and users who hit a database permissions error can ask Bolt to fix the table permissions.
Key Takeaways
- New Bolt database tables are private by default from October 30, so apps need explicit permissions to read or write data.
- Existing databases are unaffected, so projects built before the change keep working as they did.
- Bolt is expected to configure permissions automatically when it creates a new database, so most builders should not notice a difference.
- A new database permissions error can be a side effect of the change, and builders can resolve it by asking Bolt to fix the table permissions.
- The default reduces the risk of accidentally exposed data in quickly built apps by starting from a locked-down state.
- The update continues Bolt's recent security-focused work, following its one-click security audits.
What Changed
Starting October 30, Bolt began creating new database tables as private by default. Previously, a freshly created table could be reachable without further setup. Now an app needs explicit permissions before it can read data from or write data to a new table. The change shifts the starting point from open to locked down, which reduces the chance that a newly built app exposes data by accident.
Who Is Affected
The change applies to new tables in new databases. Existing databases keep their current behavior, so projects that were already built and published are not altered by this update. Builders who start new projects after the rollout are the ones who will notice it.
What Users Should Expect
When Bolt creates a new database, it is expected to configure the matching permissions itself, so most builders should not need to do anything extra. In some cases, however, an app may be missing the permissions it needs. A database permissions error in a new project may now be a side effect of this change. In that case, users can ask Bolt to fix the table permissions, and the agent can set up the access rules the app needs.
Why It Matters
Open-by-default tables are a common source of data exposure in quickly built apps, especially for builders who are not database specialists. Making tables private until permissions are granted gives new Bolt projects a safer baseline, in line with Bolt's recent security work such as one-click security audits. The tradeoff is a small amount of friction: new apps may need a permissions fix before data flows correctly.