Coding Assistants
Bolt.new
High riskBrowser-based AI app builder from StackBlitz that generates, runs, and deploys full-stack JavaScript applications from prompts, popular with founders and rapid prototypers.
Is Bolt.new safe for confidential data?
Bolt.new's primary risk is not the vendor's data handling but what its output does in production: a 2026 automated scan of apps deployed through major AI builders reported that roughly 15 percent of Bolt-generated apps shipped hardcoded API keys in client-side JavaScript — including live Stripe keys, Supabase service-role keys, and at least one OpenAI key attached to a billing account — and about 7 percent had Supabase databases with row-level security disabled. Bolt compresses prompt-to-deploy into minutes, and users routinely publish without an auth or secrets audit, so any key ever pasted into a Bolt project should be treated as potentially public. StackBlitz's own platform-side commitments (training, retention, certifications) are thinly documented publicly; get them in writing for team use.
Risk by plan
The same product often carries very different terms depending on the tier — consumer plans are where the exposure concentrates.
Consumer terms, no organizational agreement; the tier where shadow adoption and unaudited deployments happen.
Higher limits and collaboration; published data-use and compliance specifics are thin — request the current terms, DPA, and any attestations directly from StackBlitz.
Data handling
Training on inputs
StackBlitz does not clearly publish per-tier statements on whether Bolt prompts and project content are used for model training — treat as unverified and confirm in writing before team adoption.
Retention
Projects, prompts, and any secrets pasted into them persist in Bolt's cloud workspace; deployed apps additionally embed whatever the generator put in client-side code.
Residency
US-based vendor on global cloud infrastructure; no published residency controls. Canadian firms with PIPEDA or Quebec Law 25 obligations should assume US/global processing.
Compliance
- SOC 2Not verified
- GDPR / DPANot verified
- HIPAA BAANot verified
Certifications typically apply to specific tiers and contracts — confirm scope in writing before relying on them.
New to these frameworks? See our plain-language guides to SOC 2 and the other AI compliance standards.
Enterprise controls
- Team workspaces on paid plans
- Private projects
- Deployment management via connected hosting
- Published compliance attestations: not verified — request directly
Frequently asked questions
Does Bolt.new leak API keys?
The pattern is well documented: a 2026 automated scan reported about 15 percent of Bolt-generated apps had hardcoded API keys sitting in client-side JavaScript — Stripe keys, Supabase service keys, and a billed OpenAI key among them — where anyone can read them with the browser dev tools. The cause is generated code plus users deploying without an audit, not a breach of Bolt itself, which means every Bolt deployment needs a secrets and auth review before it touches real payments or user data.
Is Bolt.new secure enough for a production app?
Only after human review. Beyond client-side keys, the same scanning found roughly 7 percent of Bolt apps ran Supabase with row-level security off, leaving tables readable by anyone with the public URL. Move all secrets server-side, enable and test RLS on every table, and have someone who understands auth walk the generated code before launch — the tool optimizes for shipping fast, and the security defaults are yours to fix.
A colleague already deployed a customer-facing tool from Bolt. What is the exposure?
Assume any credential ever pasted into that project is compromised until checked: rotate the keys, inspect the deployed bundle for embedded secrets, and verify database access rules. Structurally, that build happened outside any agreement with StackBlitz and outside your review process — which is the recurring shape of vibe-coding risk, and the reason unsanctioned builder tools deserve the same monitoring as unsanctioned chatbots.
Policy changelog
- Initial entry published from cited security coverage; StackBlitz platform commitments marked unverified where not published.
Sources
- HIPAA Vault: AI coding tools keep hardcoding API keys
- Vibe App Scanner: Bolt.new security vulnerabilities
This profile summarizes the vendor's published policies as of the verification date. It is not legal advice.
Bolt.new is probably already in your organization.
Sanitized AI shows you who is using it and redacts sensitive data from prompts before it leaves your control.
More AI tool profiles
AWS's AI coding assistant and agent for IDEs, the CLI, and the AWS console, with completions, chat, and code transformation tied into AWS accounts.
AI-first code editor that sends repository context to hosted models for completions, chat, and multi-file agentic edits.
Autonomous AI software engineer that plans and executes multi-step development work with its own shell, browser, and repository access, sold to teams and enterprises.
AI pair programmer integrated into editors and the GitHub platform, offering code completion, chat, and agentic coding workflows.