AI builder · default hosting *.bolt.host
Bolt.new writes a full project in the browser and publishes it to its own hosting or to Netlify. On default hosting it is obvious: the address ends in bolt.host.
Exported to another host, a Bolt project is usually a plain Vite and React build with nothing left to identify it. That is the honest limit of any code-based detection, and our scanner reports it as such instead of guessing.
The verdict and the evidence are free. The improvement report needs a free account.
*.bolt.host is Bolt hosting.bolt.new, stackblitz or a generator meta tag naming either./assets/ and search for supabase: Bolt projects very often use it, with the key in the file.x-nf-request-id appears alongside the bolt.host address.These are the rules enabled in the database right now, with the weight each one carries. A single strong match is enough to name the builder; the weights decide how confident the verdict is.
| Rule | Where it looks | What it matches | Weight |
|---|---|---|---|
| Bolt generator meta tag | the generator meta tag | bolt\.new|stackblitz | 95 |
| Bolt hosting domain | the site address | (^|\.)bolt\.host$ | 95 |
| Bolt source marker | the page source | bolt\.new/~|built with bolt|__bolt | 85 |
| Bolt / StackBlitz reference in the JS bundle | the JavaScript bundle | bolt\.new|webcontainer-api | 70 |
We found a Supabase key in the JavaScript bundle of most Bolt sites we scanned. An anonymous key is meant to be public, but only if row-level security is switched on in the database. Many projects never turn it on, and then the key is enough to read every row.
Bolt output is typically a single-page app without a per-page title, description or canonical URL, so every route shares the same entry in search results.
Generated contact forms often post to a placeholder endpoint. The visitor sees "thank you" and the message is never delivered.
Only if something from the project stayed behind: a generator tag, a bundle marker, or Bolt hosting. A clean export on your own host carries no marker, and we say so rather than inventing one.
It depends on row-level security. With it on, an anonymous key exposes only what you allow. Without it, anyone who opens your bundle can read your tables. Check this first; it is the single most common serious issue on AI-built sites.
