Are Bolt.new API routes authenticated?

Bolt.new often generates API routes without authentication middleware, leaving endpoints accessible to anyone who discovers them. This means sensitive operations like data creation, modification, and deletion can be performed by unauthenticated users. Even when authentication is present, authorization checks that verify whether the authenticated user should have access to specific resources are frequently missing. This can lead to Insecure Direct Object Reference (IDOR) vulnerabilities. UNPWNED checks common public API paths for unauthenticated reachability, exposed response data, CORS, rate-limit, and error-disclosure signals. Object-level authorization still requires API-specific testing or code review.