Built it in Bolt. Is it safe to share the link?
Bolt makes it easy to call OpenAI, Stripe or Supabase straight from the page — and just as easy to ship the secret key with it. Paste the URL of your deployed Bolt app and see what a stranger can find in it.
Free, no sign-up. The basic check makes only the requests an ordinary browser would.
What we check on a Bolt app
- CriticalFree check
An OpenAI, Anthropic or Stripe secret in the frontend
A key called from the browser is a key anyone can copy. We search the page and its scripts for known key formats and show what we found, redacted.
- CriticalPro
Supabase tables open to anyone
If your Bolt app uses Supabase, we check after domain verification whether its tables can be read with the public key — counting rows, never reading them.
- MediumFree check
Security headers your host didn’t add
Netlify and similar hosts serve what you configure. Without a Content-Security-Policy and HSTS the site is easier to attack and to impersonate.
- MediumFree check
Broken assets and console errors
Scripts that fail to load and JavaScript errors on the live page — the kind of thing that works in preview and breaks in production.
A prompt Bolt understands
The report gives you a ready prompt: the problem, where it is and how to verify the fix. Paste it into Bolt and let it make the change.
Fix these issues on my-bolt-app.netlify.app. 1. An OpenAI API key (sk-…a3F9) is in assets/index-c41e.js. Revoke it in the OpenAI dashboard, move the call into a serverless function and read the key from an environment variable there. 2. No Strict-Transport-Security header. Add it in netlify.toml for all paths. When done, re-check: https://scanyoursite.app/en?check=my-bolt-app.netlify.app
Bolt rewrites, we re-check
With Pro we notice every redeploy and check the new version within minutes: is it up, does it render, did a key slip back into a script. You hear from us only when something new breaks.
See plansQuestions
Do you need access to my Bolt project?
No. We check the deployed site from the outside, like a visitor. Nothing to install, no account to connect.
I found a key. What now?
Revoke it with the provider first — assume it has been copied. Then move the call to a server function. The report’s prompt walks your AI through it.
Does it work with Firebase?
Key detection works for any frontend. The table-level check is for Supabase only.
Paste your URL. Get the list in about a minute.
Every finding comes with what it means for you and how to fix it — or a prompt your AI coding tool can apply.
Free, no sign-up. The basic check makes only the requests an ordinary browser would.