Bolt.new added a broader automatic security check that runs at publish time, scanning for known vulnerability patterns before an app goes live. It's a genuinely useful default to have sitting in the publish flow itself, and worth understanding precisely what it catches, since "published through Bolt" and "checked for security" aren't quite the same sentence.
What running at publish time actually means
Rather than requiring a builder to remember to run a separate check, the scan happens automatically as part of the normal publish step, which is exactly where a check like this belongs: the point right before an app becomes reachable by anyone. That timing alone removes an entire category of "I meant to check this later and never did."
What it's built to catch
A publish-time scan like this is generally built around known, common vulnerability patterns: exposed keys, missing access restrictions, and similar well-defined issues that show up repeatedly across apps built the same way. That's a meaningful, real net, and it catches the categories of mistake that are common enough to be worth checking for by default in every single publish.
What a pattern-based, automatic check at publish time can't reach
- Business logic specific to your app: whether a particular workflow lets someone skip a step, or a discount applies more times than it should.
- Whether a third-party service you've connected is itself configured correctly on its own end, outside of anything Bolt can see.
- Issues that only appear when two individually fine features are combined in a specific order or context.
- Anything about how the app is actually used once real customers and real data are involved, versus how it looks at the moment of publishing.
The honest takeaway
A check built directly into the publish step, running automatically without anyone needing to remember it, is a real, positive shift, and it's genuinely worth having on by default rather than skipped. It's still a pattern-based check against known categories, run at one moment in time. It isn't the same thing as someone actually testing your specific app's specific features the way a real user, or a real attacker, eventually will.