Is Bolt.new safe for production?

Bolt.new is designed for rapid prototyping and can generate working applications, but the output typically requires security review before production deployment. The AI generates code that works functionally but may skip important security patterns like proper session management, secure cookie configuration, and error handling that prevents information leakage. Database queries generated by Bolt.new may also lack parameterization, creating SQL injection risks. UNPWNED can assess externally observable cookie, endpoint, dependency, configuration, and error-disclosure signals. Session and database-query logic require code review. SQL-injection, reflected-XSS, and path-traversal probes are not enabled in the current production profile.