Bolt: database security audit, secrets and server functions
1. Know what Bolt set up for you
Bolt creates a database automatically when your project needs one. Sign-up and log-in may not be added automatically; you prompt for them. Know which features your app actually has: tables, file storage, authentication, server functions.
2. Run the Security Audit
In your database settings, Bolt's Security Audit checks the database for issues "such as an open permission or a missing RLS policy" and can ask Bolt to fix them. Bolt notes it checks your database only, not your whole project, so you still need to review the rest.
- Run the audit before publishing and after any change to tables or sign-in.
- Confirm every table with user data has an access policy (see our RLS guide).
3. Check file storage buckets
Bolt's File storage view shows which buckets are public or private. Anything users upload privately (IDs, invoices, photos) should be in a private bucket.
4. Put credentials in Secrets
Use Bolt's Secrets for API keys and passwords that connect to outside services. Never paste them into frontend code. Call third-party APIs from server functions, not from the browser.
5. Review server functions and logs
- List your server functions and delete the ones you don't use.
- For each remaining function, confirm it checks that the caller is signed in (and allowed) before reading or writing data.
- Glance at auth and function logs after launch for unusual spikes.
Prompt you can give Bolt
List every server function in this project, what it does, whether it requires a signed-in
user, and which tables it reads or writes. Add an auth check to any function that changes
data. Do not put any API key in client-side code; use Secrets.