Scan your Bolt site before you ship
Bolt (bolt.new) builds full-stack JavaScript apps in the browser and deploys them in a click, commonly to Netlify, often with a Vite or Next.js front end and Supabase behind it.
Free · No signup · Only scan sites you own or have permission to test
Common Bolt launch issues
🛡️ Security
- Keys you give Bolt for third-party APIs can get inlined into front-end code, where anyone can read them in DevTools.
- Environment variables prefixed for the client (e.g. VITE_ or NEXT_PUBLIC_) are bundled into the browser by design, so secrets must never use those prefixes.
- Default deployments typically don't add a CSP, HSTS or clickjacking protection.
🔎 SEO
- Vite single-page apps render in the browser, so crawlers and social previews may see an empty page.
- Placeholder titles and descriptions from the starter template sometimes ship to production.
⚡ Performance
- Unused dependencies added during iteration can bloat the JavaScript bundle.
What ChillScan checks on your Bolt site
- ✓ Secrets in inline scripts and first-party JS bundles
- ✓ CSP, HSTS, X-Frame-Options and other headers
- ✓ HTTP→HTTPS redirects and mixed content
- ✓ Title, description, Open Graph, robots.txt and sitemap
- ✓ Response time and JS weight
ChillScan reads only what a visitor's browser receives. It doesn't run JavaScript and can't scan pages behind a login or bot protection. See every check → · See a sample deep report →