Security for apps built with Bolt.new

Bolt.new builds your app in the browser, and the sandbox export carries root .env files along with it. Deploy it as-is and your keys are public.

The fix: deploy to your own Vercel/Netlify with environment variables, check for .env* in the root before exporting, and proxy AI calls through a serverless function.