Bolt App Penetration Testing
A Bolt app can use Bolt’s own database or Supabase, and your access rules decide who reaches what. We test those rules, your secrets and payment logic on the published app. CREST-certified testers, fixed price from £2,270 for a 2-day single-app scope, quoted within 24 hours.
- Unlimited retesting
- Unlimited pre-retesting
- No hidden fees
“I would highly recommend EJN Labs to any organisation seeking reliable, detailed, and well-managed penetration testing services, particularly for government or enterprise-level projects.”
“There wasn’t another company we could find that could deliver what we needed in the timeframe we needed. The client loved it, and we got instant ROI from the engagement.”
Bolt runs its own automated security check before you publish. It has a defined scope, and what falls outside that scope is what we test.
What Bolt’s built-in security audit covers, and where it stops
A Bolt project can run entirely on Bolt’s own infrastructure or mix in outside services. New projects get a Bolt database by default, with the option to connect Supabase for more advanced database control, and the app itself publishes to a free bolt.host address or to a connected Netlify account. Which combination your build actually uses changes where we look first, so we confirm it during scoping rather than assuming.
Bolt includes its own security audit, run from the Publish menu, which checks who can see and change your data, what your app makes public, how sign-in and sign-out behave, and whether private keys have ended up in your project’s code or been sent to a visitor’s browser. It is a genuine check, fixes some issues automatically, and is capped at 30 runs a day. It is also an automated pass with a fixed list of what it looks for.
What an automated audit cannot fully judge is whether a row level security policy actually scopes data to the right user, whether a server function trusts input it should verify, or whether a webhook checks its signature the way our Stripe testing expects. We test the application you publish, not Bolt’s own platform, against each of the areas below.
SCOPE
What we pen test on a Bolt application
Authentication and sign-in settings
Bolt Database ships with email sign-up, leaked password protection turned on by default, and an optional Google sign-in connection. We test whether a breached password is still accepted, whether email confirmation can be skipped, and whether signing out actually ends the session.
Tenant and account isolation
A Bolt project can serve every customer from one shared database, so account boundaries live entirely in your data rules rather than in separate infrastructure. We test whether one signed-in account can read, change or delete another account’s rows or files.
Row level security on Bolt Database and Supabase
Both a Bolt database and a connected Supabase database enforce access through row level security policies, and Bolt’s own audit warns when it finds a policy that always evaluates true. We test whether each policy actually scopes rows to the requesting user, not just whether the audit is clear.
Database permissions beyond the automated audit
Bolt’s Security Audit reviews who can see and change your data as an automated pass, but it does not replace a manual review of table permissions and rules that combine across more than one policy. We check table-level read, write and delete access by hand.
Secrets and the published client bundle
Server functions read secrets such as API keys and database passwords so they never reach a user’s browser, and this is by design rather than something the front end enforces. We check the published bundle and network traffic for a key that should have stayed server-side.
Server function and edge function authorisation
Server (edge) functions in a Bolt project handle payments, webhook receipts, authentication logic and calls to external APIs, keeping that logic off the user’s device. We test each function’s own authorisation and input handling, not just that reaching it requires a session.
Stripe checkout, webhook and subscription logic
Bolt’s Stripe integration creates edge functions for checkout sessions, webhook processing and subscription management, with products synced from your Stripe dashboard. We test for price and quantity tampering, webhook signature handling, and whether a cancelled or trial subscription can still reach paid features.
File storage and upload handling
A Bolt database includes a file storage section for files your users upload. We test the upload path for file type and size limits, and whether one account can read or overwrite another account’s stored files.
Business logic and workflow abuse
Bolt’s own audit already looks for ways an app can be misused, such as changing a price, skipping a required step or reusing a single-use item. We test the same class of workflow logic by hand across the parts of your build an automated pass will not fully cover.
Hosting, custom domain and published-site configuration
A Bolt project publishes to a free bolt.host address by default or to a connected Netlify account, with custom domains available on paid plans. We test the live published site, whichever hosting path you use, for the same configuration and transport issues we check on any hosted web application.
OUR PROCESS
Bolt-built Applications Penetration Testing: From Scope to Attestation
Scope the build
We confirm whether your project uses Bolt Database or Supabase, and Bolt hosting or Netlify, before testing starts.
Test as a real account and without one
We attack authentication, row level security and tenant isolation the way a signed-in user or an anonymous visitor would.
Trace secrets and server functions
We check what your published bundle exposes and whether server functions, webhooks and payment logic trust input they should verify.
Report and retest
You get a written report mapped to your framework, and a free retest once fixes are in place.
CREDENTIALS
Verified Accreditations Auditors Accept
Every credential below is independently verifiable. UK procurement teams, FCA supervisors, ISO 27001 / SOC 2 auditors, and cyber insurance underwriters all recognise these standards.
GET YOUR QUOTE
Get a CREST Bolt pen test quote in 24 hours
A fixed-price quote back in one business day, from a named CREST assessor. No sales pipeline, no chasing.
- CREST and IASME accredited. Testing your auditors and clients already recognise.
- Fast-track testing within 24 hours where required. Free retest of every fix included.
- Live findings via your client portal, not a four-week PDF.
- Fixed price from £3,500 for a single-role, single-app scope, agreed up front. Most engagements run £5,000 and up. No day-rate surprises.
Dan WilcocksonFounder, CelloriUnder NDA Further named references available on a scoping call.
- We reply within one business day with a fixed-price quote from a named CREST assessor.
- You approve the scope and we book a start date, usually within 24 hours.
- Live findings land in your client portal as we test, with a free retest of every fix.
Get your fixed pen test quote in 24 hours
Quote request received
We will reply within one business day with your fixed-price quote from a named CREST assessor.
Your data stays with us. No newsletter signup.
or book a 20-min scoping call first
We reply within one business day. Your data stays with us. No newsletter signup.
COMPLIANCE READY
Reports Mapped to Every Framework
Findings are written so your team can reference the report against each framework without translation work.
ISO 27001:2022
Annex A.8.8 management of technical vulnerabilities plus A.5.15-5.18 and A.8.2-8.5 access control validation.
SOC 2 Type I & II
CC6 logical access, CC7 system operations, CC8 change management evidence.
PCI DSS
Requirement 11.4 application penetration testing across cardholder data environments, including ecommerce penetration testing for online retail platforms.
FCA SYSC
SYSC 4.1.1R, 6.1.1R, 13 mapped to each finding for FCA-regulated firms.
UK GDPR
Article 32 effectiveness testing, customer-data security controls, ICO-acceptable evidence.
Cyber Essentials Plus
Direct certification through our IASME body status, single-vendor delivery.
PRICING
Transparent Bolt-built Applications Penetration Testing Pricing
Pricing depends on the number of roles, integrations and environments in scope. See our pricing page for how we quote.
2 to 3 testing days
Single user role, basic CRUD application, marketing website with auth. Around 5 working days from kickoff to report.
Get a fixed quote3 to 4 testing days
Multi-role SaaS, business application with payment integration. Around 8 to 12 working days from kickoff to report.
Get a fixed quote4 to 6 testing days
Multi-tenant platform, complex authorisation matrix, integration-heavy applications. Around 15 to 20 working days from kickoff to report.
Get a fixed quoteSECTORS
Sectors We Test Bolt For
Sector-specific scoping for regulated UK organisations.
Fintech & FCA-Regulated
FCA SYSC, Open Banking FAPI 1.0, PSD2 SCA, payment-flow scrutiny, KYC/AML testing.
Fintech sector pageSaaS Companies
SOC 2 Type I & II evidence, multi-tenant boundaries, role escalation, customer-tenant isolation.
SaaS sector pageLaw Firms
SRA Cyber Standard, privileged data, conveyancing fraud defence, partner-tier procurement.
Law firm sector pageHealthcare
NHS DTAC, DSP Toolkit v6, UK GDPR Article 32, EHR systems, telehealth platforms.
Healthcare sector pageInsurance
FCA / PRA Operational Resilience, cyber underwriting, claims data, broker portals.
Insurance sector pagePublic Sector
CCS / G-Cloud framework, NCSC-aligned, citizen-facing services, PSN-compliance scrutiny.
Public sector pageWHY EJN LABS
What You Get From Bolt-built Applications Penetration Testing
Six concrete differentiators competitors don’t all match.
CREST-Certified Testers, Verifiable
Every test by a CREST-certified pen tester (CRT, CCT APP, CCT INF where applicable). Verify our company status at crest-approved.org.
24-Hour Startup, Where Required
From signed scope to active testing in a single business day for incident response, audit deadlines, or regulator-driven timelines.
Live Findings, Not 4-Week PDFs
Critical issues reported during testing through your client portal. Your team remediates while testing continues.
Audit-Ready Reports
Executive summary plus full technical report with CVSS scores and explicit framework mappings (ISO 27001, SOC 2, PCI DSS, FCA SYSC).
Free Retests, Standard
Verify remediation of every finding before close-out. Letter of attestation for audit submission included. Most competitors charge £1,500-£3,000 per retest.
UK-Based CREST Testers
Every engagement performed by vetted, UK-based CREST-certified testers, matched to your needs, security clearance, and compliance scope.
FAQ
Frequently Asked
What access do you need to test a Bolt app?
We need one or two test accounts in your published app, one per role if the app is multi-tenant. If you want your database, secrets and server function settings reviewed alongside the running application, read-only access to those Bolt project settings speeds up the test but is not required.
Does testing touch live data?
Wherever possible we test against a staging build or test accounts you create for us, agreed during scoping. If your Bolt project only has one environment, we set rules of engagement that rule out destructive actions against real customer records before testing starts.
How long does a Bolt app test take?
A single Bolt application is typically a 2-day scope, starting within 24 hours of confirming scope. A build with multiple roles, a payment integration or several server functions may need more time, priced as shown below.
Do you test Bolt Database and Supabase differently?
The approach is the same either way. We check row level security policies, table permissions and authentication settings whichever database backs your project. If Supabase is connected, see our Supabase security review for how we test that database in more depth.
Is Bolt’s own platform in scope?
No. We test the application, database and configuration inside your Bolt project, never Bolt’s or StackBlitz’s own infrastructure, admin tooling or other customers’ projects. If your app is published to Netlify, the published site and its configuration are in scope; Netlify’s own platform is not.
What is out of scope?
Bolt’s builder interface, the AI code-generation process itself, and any third-party account you have not authorised us to test are out of scope. We agree the exact boundary with you during scoping.
Does Bolt have a customer penetration-testing policy?
We check Bolt’s and Stripe’s current terms of service and any published testing guidance for each engagement, since these can change. Where a vendor sets notice periods or rules of engagement for testing an integration such as Stripe, we follow them and build any notice period into your scope timeline.
20+ CREST-accredited testing services in one place
Web, mobile, API, cloud, AI, infrastructure, red team. Pick the test that fits your environment.
Get a fixed price for your Bolt application
A Bolt app can use Bolt’s own database or Supabase, and your access rules decide who reaches what. We test those rules, your secrets and payment logic on the published app. CREST-certified testers, fixed price from £2,270 for a 2-day single-app scope, quoted within 24 hours.
