Bolt.new Ships a Free Security Agent That Fixes Vulnerabilities Before You Publish

Bolt.new just shipped a Security Agent: an AI that reads your entire project, finds vulnerabilities, writes fixes, and applies them before you hit publish. Every audit, every patch, on every plan, at no cost.

A real problem getting worse fast

Apps built through natural-language prompts with minimal human code review have a documented security crisis. A scan of over 5,600 publicly available vibe-coded applications found more than 2,000 vulnerabilities, 400+ exposed secrets, and 175 instances of PII including medical records, IBANs, and phone numbers. Those were live production systems. Studies put the rate of vulnerabilities in AI-generated code at 45%, and the failure modes repeat across every platform.

The most common issues in Bolt.new apps are exposed Supabase service_role keys, missing Row Level Security (RLS) policies, XSS from unescaped user input, and authentication that runs only client-side and can be bypassed. RLS is a database-layer permission system controlling which rows a user can read or write. When it's disabled, any authenticated user can query every row in every table. Most incidents aren't caused by sophisticated attacks. A key ends up in a bundle, a scraper finds it, and the breach happens within the first 24 hours after launch.

What the Security Agent actually does

The flow is three steps: scan, fix, publish. Bolt reads the entire project, surfaces vulnerabilities, patches what it finds, then lets you ship the hardened version. According to the announcement, the agent covers the most common vulnerability classes found in penetration testing:

• Access controls and broken authorization
• Authentication flows and session handling
• Business logic flaws
• Database policies, including RLS enforcement
• XSS (cross-site scripting) attack vectors
• Sensitive data protection and secret exposure

Bolt has had vulnerability scanning since launch, but the new agent goes further by writing and applying fixes autonomously rather than just surfacing issues. The security review can also run automatically before every publish, making hardening part of the deploy loop.

Security built into generation, not added after

The Security Agent is the visible layer, but Bolt's approach starts earlier. The platform executes code entirely client-side in a zero-trust environment and bakes secure defaults into every project it generates:

• Row Level Security enabled by default when touching a database
• Parameterized queries and safe output escaping throughout
• Session and password handling drawn from proven patterns
• Security constraints embedded in the system prompts that drive code generation

A new "Prevent Leaked Passwords" setting checks passwords against known breach databases at account creation. If there's a match, the user is prompted to choose a different one.

Works alongside your existing security stack

For teams already running enterprise security tooling, the agent acts as a first pass. Bolt integrates with Socket Security for supply chain and dependency scanning, XBOW, and JFrog. The intended workflow positions Bolt as the initial hardening layer before the application reaches your CI/CD pipeline. Pre-hardening the app means fewer noisy findings downstream and a cleaner handoff to production.

The industry context

Gartner's Predicts 2026 report forecasts that prompt-to-app approaches adopted by citizen developers will increase software defects by 2,500 percent by 2028. Treating security as a separate phase after building is increasingly untenable when build cycles run in minutes. Bolt's bet is that the answer is embedding security into the agent itself rather than asking builders to remember a checklist before launch.

Free pricing matters here too. Removing cost as a friction point means solo builders and indie developers who would otherwise skip security review have no reason to. Bolt is SOC 2 Type 2 certified and compliant with GDPR and CCPA. For teams with formal compliance requirements, the full trust profile includes audit reports and vendor documentation.

What it won't catch

The agent handles known, repeatable vulnerability classes well. Harder problems are architectural. BOLA (Broken Object Level Authorization), where an API endpoint authenticates the user but fails to verify ownership of the requested object, is the most prevalent access control vulnerability in vibe-coded apps, and automated scanning frequently misses it because detection requires understanding business logic, not just code patterns.

For production applications with sensitive data, complex business logic, or regulatory requirements, the Security Agent closes the gap significantly on common cases. Edge cases still need human review, architectural decisions, and purpose-built security audits that automated agents can't yet replace.

The agent is available now at bolt.new. Hit publish on any project to trigger the scan.