Start with Bolt’s own check
Open your database settings in Bolt and go to Security. Bolt looks for tables with no access rules and rules that are too open, and it’s on every plan. Fix what it lists, then check again.
Then check these yourself
Every table has access rules
Bolt turns them on for tables it creates. Check any table you added another way. A table without them can be read and changed by anyone.
Private data sits behind a sign-in
Sign up as two test users. Logged in as one, try to open the other’s page by changing the address. You should get nothing.
No secret keys in the website
A Stripe secret key or an AI key must never reach the browser. If one has, treat it as leaked and replace it.
Paid features check who’s asking
Hiding a button isn’t a lock. The server has to refuse the request too.
What these checks can’t see
Bolt’s check looks at your database, not your code. A free scan looks at your live app from the outside. Neither can tell you whether payments can be faked or whether your app’s own requests hand one user another user’s data. That takes someone reading how your app works.
A clean result means these checks found nothing. It doesn’t mean your app is safe.
When to ask an engineer
Before you take payments, before you store anything personal, or before you put the app in front of a lot of people.
Next steps and sources