How to secure a Bolt.new app?

Begin by auditing all API routes for proper authentication and authorization checks. Move any hardcoded secrets to environment variables and ensure they are not exposed in client-side bundles. Add input validation and sanitization on both client and server, and implement Content-Security-Policy headers to mitigate XSS attacks. Configure CORS to only allow requests from your own domain rather than accepting all origins. UNPWNED provides a comprehensive scan covering secrets exposure, header configuration, CORS policy, and API security for Bolt.new applications.