Public env vars, the Supabase anon key, and row level security in Bolt
By ShipSecurely Editorial · Updated · How we make these guides
high
Bolt projects that use Vite follow the VITE_ rule above. Remove the prefix from any secret, and stop reading that name from import.meta.env in client code.
Fix for Bolt
Bolt projects that use Vite follow the VITE_ rule above. Remove the prefix from any secret, and stop reading that name from import.meta.env in client code. Keep the Supabase project URL and publishable key in VITE_ names only after row level security is on and you have read the policies. Do not put the secret key in a VITE_ variable.
The five-minute check, the other platforms, and the agent prompt are on the full guide. More Bolt fixes are on the Bolt page.