Skip to content
ShipSecurelySecurity reference
Menu

23 tools · 100 fixes · 27 incidents tracked · Updated Oct 14, 2026 · Sources: GitHub, Supabase, OWASP, Stripe + 24

Bolt

Bolt apps, secrets, and Supabase access in Bolt

criticalUpdated Oct 14, 2026

Remove the VITE prefix from any value that is a secret, and stop reading it from import.meta.env in client code. Call the third party from a server or edge function.

Fix for Bolt

Remove the VITE_ prefix from any value that is a secret, and stop reading it from import.meta.env in client code. Call the third party from a server or edge function. Keep the Supabase publishable key as the client key only after RLS is on.

The five-minute check, the other platforms, and the agent prompt are on the full guide. More Bolt fixes are on the Bolt page.