Your operating system account
The boundary for local files and keys.
Trust
What Bolt protects against, and what it does not.
A security review is not trying to prove a product is perfect. It is trying to learn what the product assumes, and whether the vendor will say so. Here are both lists, written as things you can check.
What Bolt is built to protect against
Each line describes a mechanism the product is built around, so you can check it. None of it is a promise that no flaw exists.
Other people on the same computer
The key that unlocks Bolt's local services is created with access limited to your own account: an owner-only access control entry on Windows, owner-only permissions on macOS and Linux.
The network
Bolt's local API is built to bind to the loopback address only and to require a per-install bearer token, so that other machines on your network cannot reach it.
Web pages and content inside the app
Reading another app's content, the screen, your open browser tabs or your files is built to need a deliberate click or key press from you, and to leave a receipt you can review.
A tampered update
Every update carries a signature that is checked against a key built into the app before anything is installed. The app is built to refuse a release signed before the running build was made, so that an older package is not offered as an update.
Sensitive text reaching an AI model
Common sensitive patterns are masked on your device before a prompt leaves it. When the masker cannot handle a piece of content, Bolt withholds or refuses it rather than sending it. Masking is a safeguard, not a guarantee: it does not find everything.
Searches that contain personal data
A web search whose text contains personal data asks before it leaves your device, and offers to answer privately instead.
Connected tools and agents
A third-party tool is built to reach a stored secret only after a consent that Bolt itself issues, and only while the vault is unlocked.
What Bolt does not protect against
These are limits of the approach, not bugs we are hiding. Plan around them.
Malware that already runs as you
A program running under your account can read the same local files you can. That is true of every desktop password manager and local AI tool. Bolt limits the damage with a locked vault and click-gated actions, but it cannot stop an attacker who already controls your user session.
Software that changes a per-user install
On Windows, the standard installer puts Bolt in your own user folder so that it needs no administrator prompt. A program running as your account can therefore replace those files, as with other per-user apps. The machine-wide installer used for managed fleets installs in Program Files, which only administrators can change.
A stolen, unlocked, signed-in computer
Use full-disk encryption and a screen lock. Bolt cannot tell you from someone sitting at your unlocked machine.
Hidden instructions in content you ask the AI to read
This is prompt injection. Bolt reduces the risk, but no product removes it. Review any action the assistant proposes before you approve it.
Choices about where your data goes
If you point Bolt at a model provider or a search provider, that provider receives what is sent after masking.
Four boundaries Bolt relies on
Your click or key press
The boundary for reading other apps, the screen and files.
The signed release
The boundary for updates.
The masking step
The boundary for text sent to an AI provider.
How to read this page
This page describes how Bolt is designed and built. It is written against Bolt 0.1.175 (October 2026) and will be updated as the product changes. It is not a statement that the product has no flaws. Independent testing is reported separately, in the assessment page, and where testing finds something, that report is where it appears.
Check it yourself
You can verify the update signature on any download at Verify a download, read how releases are built and signed on the supply chain page, and see what we say when we cannot know something at What we do when we do not know. To report a problem, use our vulnerability disclosure page.
Reviewing Bolt?
The reviewer packet states what we have and what we do not, on one page, written to be forwarded without edits.