Does Bolt.new validate user input?

Bolt.new-generated code typically includes minimal client-side validation for form fields but often lacks server-side validation entirely. Client-side validation alone is insufficient because attackers can bypass it by sending requests directly to your API endpoints. Without server-side validation, your application is vulnerable to SQL injection, XSS, and other injection attacks through malformed input. Always add server-side validation using libraries like Zod or Joi for any Bolt.new-generated API routes. UNPWNED checks for common injection vulnerabilities and missing input validation in your application.