Bolt: One-Click Security Audits
BoltBolt introduced one-click security audits, a new self-service scan accessible directly from the Publish menu that reviews a project's code and database for common security problems before it goes live. The audit automatically fixes most issues it finds and flags anything that needs manual attention. Running the audit and applying its automatic fixes does not consume any tokens, and the feature is available to users on paid plans.
Key Takeaways
- Bolt now runs a built-in security audit directly from the Publish menu, scanning both application code and the connected database before a project goes live.
- The audit automatically fixes most problems it finds, only surfacing issues that require manual developer intervention.
- Running the audit and its automatic fixes is free of token cost, unlike most other Bolt agent actions.
- The feature is currently restricted to paid plan subscribers, making it a premium pre-launch safety feature rather than a free-tier tool.
- This directly targets a well-documented weak spot for AI-generated apps: shipped projects frequently carry issues like missing row-level security policies or exposed keys that a built-in scanner can catch before publish.
- Embedding the audit in the publish workflow itself (rather than as a separate opt-in tool) means security review happens at the moment of highest risk — right before a project becomes publicly accessible.
Security Audits Land in the Publish Menu
Bolt has added a built-in security audit that developers can trigger directly from the Publish menu before shipping a project live. Instead of relying on manual review or third-party scanners, users can now ask Bolt to check an entire project — both the application code and the connected database — for common security problems in a single click.
What the Audit Checks
The audit inspects the project holistically rather than looking at just the frontend. This includes reviewing code for typical vulnerability patterns as well as examining the database layer for issues such as missing access controls or overly permissive rules — the kinds of problems that often show up in AI-generated full-stack apps when authentication or data-access rules are not tightened before launch.
Automatic Fixes, No Token Cost
Once the scan completes, Bolt does not simply hand back a list of problems: it attempts to fix most issues automatically. Anything the system cannot resolve on its own is surfaced so the developer can address it manually. Notably, Bolt is running both the audit itself and any automatic remediation free of token cost, removing the usual usage-based pricing friction from what is otherwise a core project health check.
Availability
The feature is currently available only to users on paid plans, positioning it as a premium safety net for teams shipping production applications rather than a feature available during free experimentation.
Why It Matters
Security has been a recurring pain point for AI-generated applications — projects built quickly with an AI coding agent often ship with exposed keys, missing row-level security policies, or unauthenticated endpoints. By folding a security review directly into the publish flow, Bolt is nudging users toward safer defaults at exactly the moment they are about to expose a project to the public internet, without requiring them to know what to look for or reach for a separate scanning tool.