What 295 public Bolt apps are leaking
We ran Shippable's static source checks over 295 public GitHub repos built with Bolt — reading committed code only, never touching anyone's live app. The leakiest of the five. bolt.new scaffolds Supabase with migrations, and those migrations ship RLS misconfigurations more often than any other builder.
- 01DB function with no fixed search_path · 50.2% of appsA security-definer function an attacker can hijack by shadowing a table or function name.medium
- 02Database tables open to the public · 42.4% of appsRow Level Security off or a public-read policy, so anyone can read the table's rows.critical
- 03Admin-rights DB function anyone can call · 35.6% of appsA Postgres function that runs with elevated rights and has no caller check, exposed to every visitor.high
- 04Users can edit their own permissions · 33.9% of appsRLS lets a row's owner update sensitive columns like role or plan — self-service admin.high
- 05Edge function with no access check · 25.1% of appsAn API endpoint that trusts the frontend to keep it safe and checks nothing itself.high
- 06Secrets made with Math.random() · 22.4% of appsPassword-reset tokens and API keys generated with a predictable random source an attacker can guess.high
- 07Storage bucket open to everyone · 20.7% of appsA storage policy anyone can read from or write to — uploaded files listable by the public.high
- 08Anyone (signed out) can write · 20% of appsAn RLS insert/update policy granted to the anon role.high
- 09.env committed to git · 18.6% of appsReal API keys and database passwords sitting in the repo's history for anyone to read.high
- 10Injectable PostgREST filter · 14.6% of appsUser input dropped straight into a .or()/.filter() string, letting a caller rewrite the query.medium
- 11View bypasses Row Level Security · 12.5% of appsA security-definer view that returns rows the caller's own policies would hide.medium
- 12Source maps published · 9.8% of appsSource map files that hand anyone your original, readable code.low
Plus 27 more check types seen less often.
See which of these your app ships
Paste your app's URL. It's free, read-only, and takes about a minute.
Compare all five builders: which AI builder ships the safest apps.
How we measured this
We found public GitHub repositories carrying the .bolt/ project folder bolt.new writes and ran Shippable's static source checks — the same code-level checks in npx shippable — over each one's committed files. We read source only: no live app was scanned and nothing was probed over the network. Figures are the share of 295 repositories where a given check fired at least once, aggregated so no repository, owner or finding is identified.