ShipPatrolScan your site for legal, security and SEO gaps, then fix them
Built with Bolt

What Bolt doesn't set up for you

Bolt builds and publishes a working app from a prompt, with its own hosting and database, and its security audit is worth running before you launch. The audit reads your project. It doesn't visit your site from three countries and argue with the cookie banner, which is where this list comes in.

What Bolt gives you

Hosting
New projects publish to Bolt hosting by default, at a free bolt.host address. Netlify is an optional alternative. Paid plans add custom domains and analytics. Source: support.bolt.new (opens in a new tab)
Database
New projects use a Bolt database by default. On Pro or Teams plans you can choose Supabase instead, or claim your Bolt database in Supabase. Source: support.bolt.new (opens in a new tab)
Stack
Bolt supports any JavaScript framework that runs on the frontend, with Node.js for the backend. Source: support.bolt.new (opens in a new tab)
HTTPS
Bolt provides SSL certificates for connected domains automatically, so sites are served over HTTPS by default. Source: support.bolt.new (opens in a new tab)

What Bolt already checks

  • A project security audit (paid plans) reviews code and database: data access between users, sign-in, misuse such as altered prices, visitor input, and keys or passwords in code or browser-visible output. You run it from the Publish menu. Source: support.bolt.new (opens in a new tab)
  • A database security check, on all plans, flags missing row-level security and policies that let everyone through. It uses the same checks as Supabase's Security Advisor. Source: support.bolt.new (opens in a new tab)
The checklist

What's still on you

  1. Analytics and pixels that load before consent

    Bolt's audit covers code and data access; its docs don't mention cookies or consent. Bolt also documents adding Google Analytics or Matomo tracking code to your site. Once it's in, it runs on every visit unless something makes it wait.

    Patch checks:Critical Trackers load before consentHigh No cookie banner

  2. A privacy policy that matches what the app does

    Your privacy policy needs to name the services the app uses: the database, sign-in, payments, email and any analytics. Bolt's docs don't describe a privacy policy feature, and a policy written before the last few features can easily miss one.

    Patch checks:Critical No privacy policyMedium Privacy policy doesn't mention services the site uses

  3. Database rules after the last change

    The database security check flags missing RLS and always-true policies, and it's on every plan. It helps when someone opens it after each change. If you switched to your own Supabase project, check there too.

    Patch checks:Critical Supabase tables readable with the public key

  4. Keys in the published JavaScript

    The audit checks for private keys in browser-visible output, which is the right question. Anything a frontend needs in the browser ships in its JavaScript, so re-check after adding a new integration, and look at the published bundle rather than the code you remember.

    Patch checks:Critical Secret API key in your JavaScript

  5. Security headers on the live site

    Bolt's hosting docs cover HTTPS and certificates. They don't describe default response headers such as Content-Security-Policy, X-Frame-Options or Referrer-Policy, or a setting to add them. Check what your published site actually sends.

    Patch checks:Medium No Content-Security-Policy header

  6. Pages search engines and link previews can read

    Bolt's docs don't describe pre-rendering or built-in SEO settings. If your app renders in the browser, crawlers and link previews may see an almost empty page. Titles, descriptions, Open Graph tags and a sitemap usually need adding by hand or by prompt.

    Patch checks:High Pages are blank without JavaScriptMedium Pages with missing or duplicate titlesMedium No sitemap.xml

  7. Renewal wording if you charge a subscription

    If the app sells a subscription, the sign-up page needs to say clearly what renews, when, for how much, and how to cancel. Bolt can build the checkout; the wording is yours.

    Patch checks:High Subscription sold without clear renewal and cancellation terms

  8. Alt text, contrast and form labels

    Accessibility isn't part of Bolt's documented audit. Images need alt text, text needs enough contrast, and form fields need labels that a screen reader can announce.

    Patch checks:Medium Images without alt textMedium Text contrast too lowMedium Form fields without labels

What ShipPatrol adds

  • Checks the live site from the UK, EU and US, accepting and rejecting the cookie banner, and records every request.
  • Compares your privacy policy with the services the site actually loads.
  • Re-scans daily or on a deploy hook and emails you when something new turns up, long after the pre-publish audit.
  • Paid reports include fix prompts written to paste back into Bolt.

ShipPatrol isn't affiliated with Bolt. Product names belong to their owners. Facts about Bolt were checked against its own documentation on 21 October 2026 and may have changed since. Not legal advice.

Free scan

Scan your Bolt site.

Paste the published address. Patch visits from the UK, the EU and the US and tells you what he finds. Free, no signup.

No signup needed. Not legal advice; every check names its source.

Sources