Scanner
Bolt security scanner
Paste the deployed URL of a Bolt app. LeakWatch reads that public site. It does not open your Bolt account, and it is not affiliated with Bolt.
The free report names every finding, with its severity and category. The most serious one is shown in full. The others keep the location, evidence, and fix prompt for the $19 Proof Report. One free scan per network every 30 days.
What this page is for
The deployed site
Bolt apps are ordinary websites once they have a public URL. The scan fetches that page and the scripts it loads.
Keys in the generated app
A live secret in the HTML or JavaScript is reported. A Supabase anon key by itself is public configuration.
Tables and files
If the anon or publishable key can read a table, that is the finding. A public .env file is reported. Row contents are not stored.
Questions
- Does this connect to Bolt?
- No. You paste the URL visitors already use. LeakWatch does not sign in to Bolt.
- Does the free scan use my one free scan?
- Yes. This is the same free scan as the homepage, with the same network limit. The report also includes the other public checks.
A Proof Report is $19 once. Monitoring is $9/month. Pro is $29/month. No subscription is required for the report. See pricing.