Are Bolt.new API routes authenticated?

Bolt.new often generates API routes without authentication middleware, leaving endpoints accessible to anyone who discovers them. This means sensitive operations like data creation, modification, and deletion can be performed by unauthenticated users. Even when authentication is present, authorization checks that verify whether the authenticated user should have access to specific resources are frequently missing. This can lead to Insecure Direct Object Reference (IDOR) vulnerabilities. UNPWNED scans your API routes to detect missing authentication and authorization controls.