Bolt Adds Security Audit Agent to Scan and Patch Every Project.

Bolt is adding an automated security audit agent to every project, giving app builders a one-click way to scan their code, patch detected vulnerabilities, harden the application, and publish the resulting build.

The company announced the feature on LinkedIn, positioning it as a built-in security engineer for each Bolt project. Users initiate the process through a Run security audit command inside Bolt.new, rather than configuring a separate scanning service or manually passing generated code through another tool.

That is a consequential addition for a platform designed to let people prompt, edit, run, and deploy full-stack applications. AI app builders have dramatically reduced the work required to produce functioning software, but they can also make it easier for inexperienced developers to ship insecure authentication flows, exposed credentials, permissive database rules, or vulnerable dependencies. Bolt’s latest release attempts to place a security check directly in the same workflow that generates and deploys the app.

According to Bolt, the agent scans the user’s entire application and then patches and hardens what it finds. It can subsequently publish the secured version, making the feature more than a passive vulnerability report.

That distinction matters. Traditional security scanners often return a list of warnings that still require someone to interpret the risk, locate the affected code, implement a fix, test it, and redeploy. Bolt is collapsing those steps into an agent-led process. For a solo founder or small business without a dedicated security engineer, that could shorten the path between discovering a problem and getting a fix into production.

The announcement does not specify which vulnerability classes the audit covers, whether it examines third-party packages and infrastructure configuration, or how it handles findings that require product-level decisions. Bolt also has not detailed whether users can inspect and approve every proposed change before publication, or how false positives and rollbacks are managed.

Those omissions make the feature best understood as an additional security layer, not a replacement for threat modelling, access reviews, penetration testing, or specialist advice for sensitive applications. Automated remediation can address common implementation mistakes quickly, but it cannot independently determine every business rule or compliance obligation.

Bolt has steadily widened the range of people who can build software on its platform, including through a free template marketplace with full-stack ready-made apps and voice dictation for turning spoken ideas into prompts. A built-in audit is a logical counterpart to those faster creation tools. If producing an app takes less technical expertise, basic security controls also need to become easier to invoke.

The practical workflow described by Bolt is short:

• Build or update an application in Bolt.new.
• Select Run security audit.
• Let the agent scan the complete app.
• Review the patches and hardening work available in the project workflow.
• Publish the secured version.

Bolt’s post only explicitly confirms the scan, patch, harden, and publish sequence. It does not provide technical documentation for the review stage, so teams should verify the resulting changes and test important application paths before deploying them to users.

For small businesses, the strongest use case may be catching routine security errors before launch or after a major change. Applications handling payments, health information, customer identities, or other regulated data will still need controls appropriate to their risk and legal requirements. The new agent lowers the barrier to running a security pass, but it does not remove responsibility from the application owner.

What is Bolt’s Security Audit Agent?

Bolt’s Security Audit Agent is a built-in feature that scans an entire Bolt.new application for security issues. Bolt says the agent can patch and harden what it finds, then publish the secured version.

Who can use the security audit?

Bolt says every project now has access to the security engineer capability. The announcement does not identify plan restrictions or separate eligibility requirements.

Does the security audit replace a professional security review?

Bolt has not claimed that it replaces independent testing or professional review. Builders should still test agent-made changes and use specialist assessment when an application handles sensitive data, regulated workflows, payments, or high-risk permissions.