Can Bolt.new apps be hacked?

Yes, Bolt.new generates functional applications quickly, but the AI-generated code often lacks security hardening. Common vulnerabilities include missing authentication on API routes, absence of input sanitization, and insecure default configurations. Since Bolt.new prioritizes rapid prototyping, security concerns like XSS prevention and CSRF protection are frequently overlooked in the generated output. UNPWNED checks externally observable secret, header, CORS, form, endpoint, dependency, and error-disclosure signals. Paid reports add remediation guidance; authentication, input sanitization, CSRF, and stored-XSS behavior require code review or targeted testing. Reflected-XSS probes are not enabled in the current production profile.