Bolt

Bolt builds and keys left in the client bundle

Bolt and Vite copy client environment variables into the JavaScript bundle. A live secret key in that bundle is already public.

Updated 2026-10-27

If a secret is present in a Bolt app's shipped JavaScript, it is public. Bolt apps are Vite projects. Variables prefixed for the client are replaced into the bundle at build time, and the bundle is what the browser downloads.

Bolt's chat will sometimes place an API key directly in a component because the prompt said "call Stripe" or "call OpenAI from the page". The preview works. The published site then contains the same string. Rolling the key in the provider dashboard is the fix. Deleting the line in a later prompt is not enough if an old deployment is still online.

Which values are public on purpose

A Supabase anon key and a Firebase web apiKey are client identifiers. They may live in the bundle. A Stripe publishable key may live in the bundle. These still need server-side rules: Supabase row level security, Firebase security rules, and Stripe secret keys kept off the client.

These must not be in the bundle:

• A Supabase service role key, or any JWT whose role claim is service_role
• A Stripe secret or restricted key meant for your server
• An OpenAI or Anthropic key
• A database connection URL that includes a password
• A private key block
• Provider tokens for GitHub, Slack, SendGrid, Resend, or AWS

Search the built files, not only the source you see in the editor. The published output is the file a scanner, and any visitor, can fetch. Source maps make that search easier for an attacker, so do not deploy a sourceMappingURL that points at your original tree unless the map is blocked.

How to keep the key on the server

Put the secret in Bolt's server environment, not in a client-prefixed variable. Call it from a server function, a route handler, or a small backend the browser talks to with the user's session. The function uses the secret. The response to the browser does not include it.

Do not "protect" a key by splitting the string, encoding it, or reading it from a public .env file. A public /.env is a file. If the host serves it, the scan will say so, and the values in it are compromised.

The same pattern shows up in Cursor and other builders when a secret is stored with a client prefix or pasted into a component. The host does not make a client variable private.

FAQ

The Bolt preview needed the key to run. Where should it go?

In the server environment for the preview and for production. The browser should call your function. The function reads the secret.

Is a test-mode provider key safe to leave in the client?

No. Test keys still control test data and can be abused. Rotate them and move them server-side. They are a weaker finding than a live key, not an invitation to publish them.

What about the .env file in the project?

Keep it off the static host. A file that your editor uses locally is not a problem until the deployed site returns it to a GET request.