Bolt.new + Supabase
Monitor the Supabase project behind your Bolt.new app
Bolt's own docs say anyone who visits your site can send requests to your database directly, without using your site's screens. RLS is the only barrier. If your Bolt app runs on a Supabase project you connected, or on a Bolt Database you claimed into your Supabase organization, Supahound scans its RLS daily for free and flags cross-tenant reads, scraping and service-key misuse.
Last updated
Bolt.new has a built-in Supabase integration.
What are the Supabase security risks in Bolt.new apps?
Unknown RLS state on a connected Supabase project
Bolt documents that it turns on RLS for the tables it creates in a Bolt Cloud database, and tells you to enable it on tables you add. Its docs do not say what it does for an external Supabase project, so check each table there yourself.
Always-true policies
Bolt's database security check warns about "RLS Policy Always True". A policy that passes for every row lets any visitor change or delete data, even though RLS is on.
Direct requests that skip your app's screens
Bolt states that any visitor can send requests to your database without using your site's screens. Hiding a button or a page in the UI hides nothing from someone who calls the API.
Authentication inside edge functions
Bolt's docs call edge functions complex because they connect up services and involve authentication steps. A function that skips the caller check exposes everything its keys can reach.
Leaked-password protection after a claim
Bolt's docs say leaked-password protection turns off when you claim a Bolt Database into a Supabase account on the Free plan. Users can then sign up with passwords already known from breaches.
How does Supahound protect your Bolt.new app?
- The free daily posture scan reports RLS coverage and Security Advisor findings, including permissive policies, on your connected or claimed project.
- Newly exposed tables show up in the next daily scan, so a table you add without RLS does not stay open for long.
- The cross-tenant read detector flags a visitor who uses an always-true policy to read rows that belong to other users.
- The database-tampering detector alerts from day one. Visitors changing or deleting data is the harm Bolt's always-true warning describes.
- After 7 days of learning, the scraping detector flags an actor who pulls tables in bulk through direct requests.
Frequently asked questions
- Does Supahound monitor a Bolt Database?
- Supahound monitors projects in a Supabase organization you authorize. A Bolt Database lives in Bolt Cloud until you claim it into your own Supabase organization, which Bolt supports. Once you claim it, or if you started the project on Supabase, connect it to Supahound.
- Does Bolt's security check cover my Supabase project?
- Bolt's Database security check scans the Bolt Cloud database with the same checks as the Supabase Security Advisor, and the Security Audit reviews code and database. Bolt's docs do not say whether either applies to a connected external Supabase project, so run the Security Advisor there too.
- Which Bolt plans can use Supabase?
- New Bolt projects use a Bolt Database by default. Supabase is an option on the Pro and Teams plans, and one Bolt account connects to one Supabase organization.
- Can Supahound stop a visitor who queries my Bolt database directly?
- No. Supahound detects and alerts; it does not sit in the request path. It sends the incident by email or signed webhook with SQL to tighten the policy, and you apply the fix.
Watch your Bolt.new app's Supabase traffic
Connect your Supabase org read-only. The free posture scan runs in minutes. No credit card.
Sources
Checked on . Products change; check each source for current details.