Best security scanner for Bolt.new

Bolt.new builds the app in the browser and the sandbox export carries .env files in the root with it. So the deciding capability isn't depth of code analysis — it's whether the scanner probes public paths on your domain and reports what can be downloaded without logging in.

Ranking: 1. Grove Vibe Check (probes public paths, classifies the key it finds), 2. Vibe App Scanner (deep DAST with human review), 3. Aikido Security (secrets in the repo and git history), 4. Snyk (dependency vulnerabilities), 5. Semgrep (rules in CI). Secrets exposed by a deploy are found by an external scan, not by code analysis.