Bolt Production Readiness

Auth Check Only in Client Code

The auth gate runs only in a client component (a useEffect redirect or conditional render), so an attacker can bypass it by calling the API route directly.

IDOR Vulnerability on REST Endpoint

A REST endpoint returns resources by id without checking the caller owns them, so any signed-in user can read another user's data by changing the id.

Missing Row Level Security on Supabase Table

A public Supabase table has RLS disabled or an overly permissive policy, so any signed-in user can read or modify every row regardless of ownership.

Secret API Key Exposed in Client Bundle

A sensitive key (Stripe secret, OpenAI, Supabase service role) has a NEXT_PUBLIC_ prefix, so it is inlined into the browser bundle for anyone to read.

Unverified Stripe Webhook

The Stripe webhook endpoint accepts any POST without verifying the signature header, so an attacker can forge subscription events or credit accounts.

Missing Input Validation on API Route

A POST or PATCH route spreads the raw request body into a database write without checking that fields exist, have the right types, or are in range.

Bolt.new Apps: 7 Production Issues and How to Fix Them

Bolt.new gets you to a working app in minutes, but its code has patterns that break in production. Seven specific issues, with code-level fixes.

Cursor vs Lovable vs Bolt: What Each Tool Gets Right (and What They All Skip)

An honest comparison of Cursor, Lovable, and Bolt: what each does well, the gaps all three leave, and how to close them before you ship.