Bolt.new Security Guide: 10 Critical Fixes Before Deploying

✓ Add Rate Limiting

// Using upstash/ratelimit (works with serverless)
import { Ratelimit } from "@upstash/ratelimit"
import { Redis } from "@upstash/redis"

const ratelimit = new Ratelimit({
  redis: Redis.fromEnv(),
  limiter: Ratelimit.slidingWindow(10, "60 s"),
})

export async function POST(request: Request) {
  const ip = request.headers.get("x-forwarded-for") ?? "127.0.0.1"
  const { success } = await ratelimit.limit(ip)
  if (!success) {
    return Response.json({ error: "Too many requests" }, { status: 429 })
  }
  // ... handle request
}

✓ Add to next.config.js or middleware

// next.config.js
const securityHeaders = [
  { key: "X-Content-Type-Options", value: "nosniff" },
  { key: "X-Frame-Options", value: "DENY" },
  { key: "X-XSS-Protection", value: "1; mode=block" },
  { key: "Referrer-Policy", value: "strict-origin-when-cross-origin" },
  { key: "Permissions-Policy", value: "camera=(), microphone=(), geolocation=()" },
  {
    key: "Content-Security-Policy",
    value: "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'"
  },
  {
    key: "Strict-Transport-Security",
    value: "max-age=63072000; includeSubDomains; preload"
  },
]

module.exports = {
  async headers() {
    return [{ source: "/(.*)", headers: securityHeaders }]
  },
}

✓ Restrict CORS

// middleware.ts
const ALLOWED_ORIGINS = [
  "https://yourdomain.com",
  "https://app.yourdomain.com",
]

export function middleware(request: NextRequest) {
  const origin = request.headers.get("origin")
  if (origin && !ALLOWED_ORIGINS.includes(origin)) {
    return new Response("Forbidden", { status: 403 })
  }
  // Set specific CORS headers
  const response = NextResponse.next()
  if (origin && ALLOWED_ORIGINS.includes(origin)) {
    response.headers.set("Access-Control-Allow-Origin", origin)
    response.headers.set("Access-Control-Allow-Methods", "GET, POST")
    response.headers.set("Access-Control-Allow-Credentials", "true")
  }
  return response
}

✓ Fixed

// Always filter by the authenticated user
const order = await db.query(
  "SELECT * FROM orders WHERE id = $1 AND user_id = $2",
  [orderId, session.user.id]
)
if (!order) return Response.json({ error: "Not found" }, { status: 404 })

✓ Secure Upload Handling

const ALLOWED_TYPES = ["image/jpeg", "image/png", "image/webp", "application/pdf"]
const MAX_SIZE = 5 * 1024 * 1024 // 5MB

export async function POST(request: Request) {
  const formData = await request.formData()
  const file = formData.get("file") as File

  // Validate type
  if (!ALLOWED_TYPES.includes(file.type)) {
    return Response.json({ error: "Invalid file type" }, { status: 400 })
  }

  // Validate size
  if (file.size > MAX_SIZE) {
    return Response.json({ error: "File too large" }, { status: 400 })
  }

  // Generate random filename (never use original)
  const ext = file.type.split("/")[1]
  const filename = `${crypto.randomUUID()}.${ext}`
  // Upload to cloud storage, not local filesystem
}

✓ Pin Everything

# Lock exact versions
npm config set save-exact true

# Review what you're pulling
npm audit

# Use lockfile integrity
# Commit package-lock.json
# Enable npm audit in CI/CD pipeline

# Check for known compromised packages
npx is-my-node-app-secure

✓ Safe Error Handling

// Global error handler
export function middleware(request: NextRequest) {
  try {
    return NextResponse.next()
  } catch (error) {
    // Log full error server-side
    console.error("Request error:", error)

    // Return generic message to client
    return Response.json(
      { error: "Something went wrong" },
      { status: 500 }
    )
  }
}

// Never do this in production:
// return Response.json({ error: error.message, stack: error.stack })