Ship It Checklist

Checklists /Bolt /Security

Critical

Lock the database Bolt created

Bolt may add Supabase, Firebase, or a hosted SQL database and leave the default rules open so the preview works. Open rules mean the first person who finds the project URL can read the data.

How to check

  1. Identify which database the app uses. Look at the client setup file.
  2. If it is Supabase, confirm row level security is enabled on every public table and policies check the signed-in user.
  3. If it is Firebase, open the rules and confirm they are not 'allow read, write: if true'.
  4. While signed out, the public site should not return other users' records.

Prompt

Fix prompt
Paste into Cursor or Claude Code
You are working in this repository. Do not add features.

Goal: the database must refuse access unless the signed-in user owns the row.

Steps:
1. Find the database client and the rules or SQL policies.
2. If rules allow public read and write, replace them. For Supabase, enable row level security and add policies on auth.uid(). For Firebase, require request.auth and match the user id.
3. Do not leave a temporary allow-all rule in the files you commit.
4. Tell me how to test as a signed-out visitor.
5. Do not print connection strings.

This uses the same ticks as the checklist page, saved in this browser.

Related error fixes