Scan your Bolt app before you ship it.
Bolt.new gets you to a running app in one prompt. Security is not part of that prompt. VibeZero reads your Bolt repo across five layers, returns one go or no-go release decision, and re-verifies every fix with a rescan.
First 3 scans are free, with no credit card. You see the launch readiness score before you pay.
What goes wrong in Bolt apps
API keys hardcoded straight into the client bundle
Bolt wires third-party services the shortest way it can, which means the key goes in the frontend source. It works immediately, it ships to every visitor, and it is the fastest way to lose an OpenAI or Stripe key.
Generated API routes with no auth check at all
A prompt that asks for an endpoint gets an endpoint. Unless you asked for authentication in the same breath, the route is reachable by anyone who finds the path, and the frontend is the only thing pretending otherwise.
Wide-open CORS and missing security headers
Permissive defaults get chosen because they make the app work during development. They stay in place at deploy, so any origin can call your API and the browser protections you would otherwise get for free are switched off.
Whatever package versions the model happened to know
Generated manifests reach for versions from the model's training data, not the current patched release, so a fresh Bolt project can start life with known vulnerabilities already installed.
Move the secrets server-side, then gate the routes
Bolt findings cluster tightly: get every key out of the client and behind a server route or environment secret, put a real authorization check on each generated endpoint, tighten CORS to the origins you actually serve, and bump the packages that shipped vulnerable. VibeZero turns each cluster into a fix task with evidence and acceptance criteria, formatted as a prompt you can hand straight back to Bolt, Cursor or Claude Code.
Most vibe coding scanners just paste your URL.
Probing a deployed app from the outside finds what happens to be reachable that minute. It cannot read the policy you never wrote, the key sitting in your git history, or the CVE three levels deep in your lockfile. VibeZero connects to the repo and scans all five layers, then scores the release.
- Code
OpenGrep across every language we detect, plus Bandit, gosec and ESLint-security where they apply.
- Dependencies
OSV-Scanner and Grype over your lockfiles, so a transitive CVE cannot hide.
- Secrets
Gitleaks and TruffleHog over the working tree and the git history behind it.
- Config
Trivy misconfiguration scanners over your infra, database policies and deploy settings.
- Running app
Live checks against your deployed URL, once you have proved you own it.