Bolt adds free, automatic security review to every project
By Steven Van ·
The agentic reviewer checks for issues like hardcoded API keys and open database endpoints as apps are built, at no extra cost.
Bolt is shipping what it's calling a security engineer into every Bolt project, running automatically and included for free. The framing from the team is direct: AI made building faster, and it made attackers faster too, so state-of-the-art agentic security is now the default rather than an opt-in add-on.
The problem it's addressing
Bolt generates full-stack apps in a single session, frontend, backend, database schema, and integration glue all at once. That breadth is the appeal, but it's also the risk surface: each layer is a place a prompt-to-app generator can skip a security control a human engineer would have caught. Security researchers auditing AI-generated apps have repeatedly flagged the same predictable issues showing up across vibe-coded projects, hardcoded API keys, open database endpoints, and missing auth checks that only become a real problem once a project is deployed and running against actual users and services.
Why 'agentic' security, specifically
The scope here is notable: this isn't a static code scanner bolted onto the build pipeline, it's positioned as an agent working inside the project, the same way the ratio of developers to security engineers has always favored developers, and now AI agents are writing and shipping code faster than any human reviewer, security or otherwise, can keep pace with. Putting an agentic reviewer directly in the loop is Bolt's answer to that gap, review that scales at the same rate the code itself is being generated, rather than a periodic audit bolted on after the fact.
Free by default matters
Security review is normally a premium add-on, if it's offered at all, and plenty of teams skip it entirely on smaller or early-stage projects. Making it standard on every project rather than a paid upsell changes the default outcome for the average Bolt user, particularly non-developers building and shipping apps who wouldn't otherwise know to look for a hardcoded key or an open endpoint before hitting deploy.
Sources: Bolt on X.