GUIDE · SECURITY
Securing a Bolt app: the essentials before launch
You check a Bolt app before launch like any other app: keys, database rules, headers and legal pages. With links to the matching guides.
1 min readLast checked
What this guide is
This guide is an overview for apps built with Bolt. We make no statements about Bolt itself. We name the spots you check from the outside on any app and link to the guides that carry the sources.
Keys outside the shipped code
Anything that reaches the browser can be read by anyone, so secret keys belong in the backend. Which keys may be public and which never, is covered in the guide on API keys in frontend code and, for Supabase, in the guide on the exposed key.
Database rules
If the app uses Supabase, every table needs Row Level Security with policies (guide “Supabase: how to enable Row Level Security properly”). If it uses Firebase, the rules are the only layer of protection (guide “Open Firebase rules”).
Security headers
Where you host the app decides how you set headers. For Vercel and Netlify, see the guide “Setting security headers on Vercel and Netlify”.
Legal notice and privacy
Whether your app needs a legal notice (imprint) and a privacy policy, and what they must contain, depends on the case, for example whether it is offered commercially and processes personal data. Also check what the page loads in the background. Details and sources are in the two privacy guides. This is not legal advice.
Run the check
The free check loads your app like a visitor and shows what is visible from the outside, without signing in and without changing anything in your app.
Sources
Check your app
The free check loads your app like a visitor and shows what is visible from the outside. You confirm beforehand that you are responsible for the app or authorised to test it.