00 / Free check for sites made with Bolt
Your Bolt app is live. Is it safe, legal, and solid?
Bolt apps frequently leak client-prefixed environment variables. Paste the address and in 30 seconds you get a grade, what is wrong in plain words, and the exact text to paste back into Bolt to fix it.
PASTE YOUR SITE'S ADDRESSNo signupWe only look, we change nothingYour pages are not stored
01 / What usually goes wrong on Bolt
The defaults that bite.
These are the mistakes we see most on sites built with Bolt. Not your fault: they are what the builder does unless you tell it otherwise.
01Environment variables prefixed for the client (VITE_ / NEXT_PUBLIC_) end up in the bundle, sometimes including real secrets.
02Missing security headers and CSP are common.
03Supabase RLS is often left off on generated tables.
The fix, in short
Move real secrets out of client-prefixed env vars, and confirm RLS on every table.
02 / What the scan covers
The same 51 checks, whatever built your site.
A sample from each area. See every check.
SECURITY
A-01CRITICAL
Anyone can read your database
Your Supabase table answers to anyone who asks, no login needed. That is your users' data, readable by strangers. We ask once, read-only, and report what came back.
A-04CRITICAL
Your Firebase database is open
Your Firebase data can be read without logging in.
S-01CRITICAL
Your master key is inside the page
The Supabase service key sits in your site's code. Whoever reads it owns your whole database, every lock ignored.
EU LEGAL INFORMATION
DE-IMP-01HIGH
No Impressum found
German law expects a provider page on commercial sites (§5 DDG). We say what we found and link the rule. General information, not legal advice.
DE-PRIV-01HIGH
No privacy notice found
EU law expects one (Art. 13 GDPR). We look for a linked page under the usual names. General information, not legal advice.
DE-PRIV-04HIGH
Your privacy notice does not mention services you use
We compare the outside services your site actually loads (analytics, fonts, maps) with what your privacy notice names.
QUALITY
Q-05aMEDIUM
Missing page title or description
Search results and browser tabs show the bare address instead of your name.
Q-09MEDIUM
Google sees an empty page
Your site only appears after code runs in the browser, so search engines and link previews see nothing.
Q-10cMEDIUM
Images without descriptions
Screen readers and Google cannot tell what your images show. An accessibility basic (WCAG).