Bolt.new Security Incidents

Here is a typical pattern found in Bolt.new generated applications where a Stripe secret key is embedded directly in client-side code:

// VULNERABLE: Bolt.new generated client-side code
import Stripe from 'stripe';

// This secret key is visible to anyone viewing the page source
const stripe = new Stripe('sk_live_51ABC...xyz');

export async function createPayment(amount: number) {
  // This runs in the browser — the key is exposed
  const intent = await stripe.paymentIntents.create({
    amount,
    currency: 'usd',
  });
  return intent;
}

The secure approach moves this to a server-side API route:

// SECURE: Server-side API route
// app/api/payment/route.ts
import Stripe from 'stripe';

// Server-side only — not in the client bundle
const stripe = new Stripe(process.env.STRIPE_SECRET_KEY!);

export async function POST(req: Request) {
  // Verify authentication first
  const session = await getSession(req);
  if (!session) return new Response('Unauthorized', { status: 401 });

  const { amount } = await req.json();
  const intent = await stripe.paymentIntents.create({
    amount,
    currency: 'usd',
  });
  return Response.json(intent);
}