Securing your Bolt.new app before it goes to production

Mis-prefixed environment variables

Bolt.new is built on Vite. Under Vite, any environment variable prefixed VITE_ is deliberately bundled into the JavaScript sent to the browser — that's documented behavior, not a bug. The problem shows up when the AI (or you, copying an example found elsewhere) prefixes a key that should never leave the server:

# .env — should never be prefixed VITE_
VITE_SUPABASE_SERVICE_ROLE_KEY=eyJhbGci...   # ❌ bypasses RLS, ends up in the public JS
VITE_STRIPE_SECRET_KEY=sk_live_...            # ❌ secret key, ends up in the public JS

SUPABASE_SERVICE_ROLE_KEY=eyJhbGci...         # ✅ stays server-side
STRIPE_SECRET_KEY=sk_live_...                 # ✅ stays server-side

Once the prefix is there, the bundler no longer distinguishes a public key from a secret one — both are treated as "meant for the client" and bundled as-is.

No security headers by default

An app generated and deployed in a few minutes has, by default, none of the HTTP headers that harden a site against clickjacking, script injection, or data leaking through a third-party subdomain: Content-Security-Policy, Strict-Transport-Security, X-Frame-Options. This isn't specific to any one generation tool — a prompt describing a feature almost never mentions these headers, and the AI doesn't add them on its own initiative.

The fix

Double-check every environment variable before deploying: if it contains a password, a secret key, or a third-party API token, it should never carry the VITE_ prefix. For headers, add them explicitly for your target host (Vercel example):

// next.config.js / vercel.json — headers added explicitly
{
  "headers": [
    {
      "source": "/(.*)",
      "headers": [
        { "key": "Strict-Transport-Security", "value": "max-age=63072000; includeSubDomains" },
        { "key": "X-Frame-Options", "value": "DENY" },
        { "key": "X-Content-Type-Options", "value": "nosniff" }
      ]
    }
  ]
}

Breakdown of the most common missing headers and why each one matters: Missing security headers.

Got an app built with Bolt.new already live? Scan it to check no secret key made it into the client bundle and that the basic headers are in place.