Ship It Checklist

Checklists /Bolt /Security

Critical

Move secrets out of the generated code

Bolt writes files quickly, and keys sometimes land in source. Anything in the repository or in a VITE_ variable is visible to people who load the site. Secrets belong in the host's environment settings.

How to check

  1. Search the project for sk_live, sk_test, service_role, whsec_, and BEGIN PRIVATE.
  2. Search for VITE_ and NEXT_PUBLIC_ variables. Their values are public. They must not hold secret keys.
  3. Open the deployed site, view source, and search the JavaScript files for those prefixes.
  4. If you find a real key, rotate it at the provider after you remove it. Deleting the line is not enough.

Prompt

Fix prompt
Paste into Cursor or Claude Code
You are working in this repository. Do not add features.

Goal: no secret key remains in source, and no secret is exposed through a client environment variable.

Steps:
1. Search for API keys, private keys, database URLs with passwords, and Stripe secrets.
2. Move each secret to an environment variable that is only read on the server. Remove VITE_ or similar public prefixes from those names.
3. If a key was committed, tell me to rotate it. Do not print the key value.
4. Add a short comment in the README listing the variable names, not the values.
5. Summarise the files you changed.

This uses the same ticks as the checklist page, saved in this browser.

Related error fixes