How to secure a Bolt.new app?

Begin by auditing all API routes for proper authentication and authorization checks. Move any hardcoded secrets to environment variables and ensure they are not exposed in client-side bundles. Add input validation and sanitization on both client and server, and implement Content-Security-Policy headers to mitigate XSS attacks. Configure CORS to only allow requests from your own domain rather than accepting all origins. UNPWNED checks externally observable secret-exposure, security-header, CORS, endpoint, rate-limit, and error-disclosure signals. Paid reports add remediation guidance; authorization and server-side validation require direct review.