Does Bolt.new validate user input?

Bolt.new-generated code typically includes minimal client-side validation for form fields but often lacks server-side validation entirely. Client-side validation alone is insufficient because attackers can bypass it by sending requests directly to your API endpoints. Without server-side validation, your application is vulnerable to SQL injection, XSS, and other injection attacks through malformed input. Always add server-side validation using libraries like Zod or Joi for any Bolt.new-generated API routes. The current UNPWNED profile checks externally observable configuration, exposure, CORS, form, dependency, and error-disclosure signals; verify server-side validation with code review or SAST. SQL-injection, reflected-XSS, and path-traversal probes are not enabled in the current production profile.