Does Bolt.new expose secrets in code?

Bolt.new can inadvertently place API keys, database credentials, and other secrets directly in client-side JavaScript files. When secrets are embedded in frontend code, they become visible to anyone inspecting the page source or network requests. This is especially dangerous with database connection strings and third-party API keys that grant write access. Always review the generated code for hardcoded credentials and move them to environment variables. UNPWNED scans for exposed secrets, API keys, and credentials in your deployed application.