Bolt.new Ships a Free Security Agent That Fixes Vulnerabilities Before You Publish
Bolt.new ships a free agentic security engineer that scans, patches, and hardens every app before it goes live — no extra charge.
- Free security agent: Bolt.new ships an AI that scans, patches, and hardens every app before publish — at no cost on any plan.
- Covers the big ones: Access controls, authentication, business logic, database RLS policies, XSS vectors, and exposed secrets.
- Massive industry problem: Escape.tech found 2,000+ critical vulnerabilities and 400+ exposed secrets across 5,600 live vibe-coded apps.
- CI/CD integration: Acts as a first-pass security layer before handing off to Socket Security, XBOW, or JFrog in your pipeline.
- Secure by default: Bolt also bakes RLS, parameterized queries, and safe output escaping into generated code from the start.
- Limitations remain: Business-logic flaws like BOLA/IDOR still require human review; the agent covers known, repeatable vulnerability classes best.
Bolt.new just shipped what it calls a Security Agent: an AI that reads your entire project, finds the vulnerabilities, writes the fixes, and applies them before you hit publish. The whole thing is free. Every audit, every patch, on every plan.
The problem it's solving is real and getting worse
Vibe-coded apps , apps built through natural-language prompts with minimal human code review , have a documented security crisis. A scan of over 5,600 publicly available vibe-coded applications identified more than 2,000 vulnerabilities, 400+ exposed secrets, and 175 instances of PII including medical records, IBANs, and phone numbers. Those weren't test environments. Every single vulnerability sat in a live production system.
Studies show 45% of AI-generated code contains vulnerabilities. The failure modes are predictable and repeat across every platform. The most common issues in Bolt.new apps specifically are exposed Supabase service_role keys, missing Row Level Security (RLS) policies, XSS from unescaped user input, and authentication that only runs client-side and can be bypassed.
RLS (Row Level Security) is a database-layer permission system that controls which rows a user can read or write. When it's off, any authenticated user can query every row in every table. Most Bolt.new incidents are not caused by sophisticated attacks , they are caused by a key in a bundle, found by a scraper, in the first 24 hours after launch.
What the Security Agent actually does
The flow is three steps: scan, fix, publish. Bolt reads the entire project, surfaces vulnerabilities, patches what it finds, then lets you ship the hardened version. According to the announcement, the agent covers the most common vulnerability classes found in penetration testing: