Skip to main content
To help keep your app’s data secure, Bolt can check your project for security problems and fix what it finds. You can run a check at any time while you’re building, but we recommend running a security check at least once before you publish. There are two types of security checks:
  • Project security audit: Reviews your whole project, including your code and database, fixes what it can, and flags anything you need to handle. Neither the audit nor its fixes use your tokens. Available on paid plans.
  • Database security check: Flags issues with your database settings so you can ask Bolt to fix them. Available on all plans.

​
Run a security audit

A security audit includes a full review of your entire project. To run a security audit:
The Publish menu with the Run security audit button highlighted.
  1. In the top-right corner of your screen, click Publish.
  2. Click Run security audit.
  3. Wait while Bolt reviews your project. You can follow the progress in the chat.
  4. To see what Bolt fixed, expand the summary in the chat.
Bolt fixes most problems on its own. Sometimes you may need to make a change yourself, like updating a setting in a service you’ve connected to your project (for example, your email or payment provider). If you have action items from the security audit, Bolt lists them in the chat and tells you what to do. The following screenshot shows how Bolt flags action items for your review.
The results of a security audit in the Bolt chatbox, with a section at the top that says Needs your action.
When an audit finishes, the Run security audit option changes to Security audit up to date. You can run the security audit again after you’ve made new changes to your project.

​
What the security audit checks

Bolt checks for the following problems. It skips anything that doesn’t apply to your project.

​
Daily limit

You can run up to 30 security audits per day. Bolt tells you when you reach the limit, which resets each day at midnight UTC. If you need to run more audits per day than the limit allows, contact support.

​
Review database security issues

Bolt can also perform a lightweight review of your database that’s independent of the full security audit. This review checks your database rules and permissions and flags anything that could make your data insecure, like a permission rule that allows anyone to read a table. You can view the results on the Security tab of your database settings. For instructions, see Database: Security settings.
The full security audit includes checks on your database. If you already ran an audit, you don’t need this separate review of your database.

​
Go back to an earlier version

To fix security issues, Bolt makes changes to your project’s code or database. If a fix updates something you didn’t want changed, you can use Bolt’s version history to go back to how your project was before. Going back to a version from before the fix also removes the security changes Bolt made. If you want to keep those changes and adjust something else, describe what you want in the chat instead.