Bolt · Security scan
Bolt, from StackBlitz, builds and runs a full-stack Node and React app entirely in the browser, then deploys it in a click.
8 security checks run automatically: secrets, CORS, headers, dependencies, config exposure, auth flaws, debug artifacts, and deployment readiness.
What we look at for Bolt
Wardloom always runs the full catalogue — these are the ones Bolt projects most often get wrong, based on how the tool tends to generate and deploy code.
We look for live API keys, tokens, and credentials sitting in client bundles or source where a stranger can copy them.
One leaked Stripe or OpenAI key can empty a wallet overnight. Catching secrets before launch is the cheapest security win for vibe-coded apps.
We probe for missing CSP, HSTS, X-Frame-Options, and related hardening headers on live URLs.
Headers are cheap defenses against clickjacking, mixed content, and script injection. Search engines and browsers both notice when they are missing.
We look for hardcoded ports and URLs, missing health checks, and environment assumptions that break outside localhost.
A deploy that only works on your laptop is not launched. Readiness checks catch the last-mile mistakes AI tools skip.
We scan your dependency tree for known-vulnerable or abandoned packages that still ship with the app.
Most vibe-coded stacks inherit risk from npm. Known CVEs are public; attackers do not need inventiveness, only an unpatched install.
Common Bolt mistakes
What a scan like this can't see
Wardloom is honest about its limits. Server-side authorization & auth logic is not something a read-only scan can verify from the outside — it requires a connected repo scan or a manual review. A clean result means nothing visible was wrong, not that everything was checked.
FAQ