Loading the catalogue…
Coding agents · StackBlitz · US
Bolt.new
US CLOUD Act exposureOpen sourceMIT
STAV REVIEW · LAST REVIEWED 06/21/2026
“Productive browser-first code generator, but prompts and code flow to US infrastructure under CLOUD Act jurisdiction, and roughly one-in-seven generated apps ship without database access controls.”
Good for
- Rapid prototyping and internal tooling where speed matters more than Sovereign data handling
- Teams who can negotiate an enterprise self-hosted Kubernetes deployment to reduce data-residency exposure
- Organisations already comfortable with SAML2 SSO via Okta, Azure AD, or GitLab who want a no-toolchain generation experience
- Developers building low-stakes, non-production experiments where mandatory code review before deployment is already the norm
Watch out for
- All prompts, submitted code, file attachments, and AI-generated outputs are stored on StackBlitz's US servers and forwarded to third-party AI providers — full CLOUD Act exposure with no fixed retention period and no confirmed SOC 2 Type II, public DPA, or SBOM
- Independent researchers have documented an unresolved pattern since December 2025: ~15% of generated apps hardcode API keys in client-side bundles and ~7% deploy databases without Row Level Security — mandatory security review before any production deployment is non-negotiable
- The public OSS repository has been frozen since December 2024 with zero commits and 8,000+ open issues; the auditable codebase has materially diverged from the live commercial product, eliminating meaningful supply-chain transparency
Editorial assessment, not legal advice. Stav's risk ratings, scores, and verdicts are our own analysis of publicly available information and may be incomplete or out of date. Verify independently before making compliance or procurement decisions.
MODEL REQUIREMENTS
What Bolt.new needs from a model.
Required
- Streaming
- Tool calling
Recommended
- Code-native
- Long context (≥128k)
- Structured output
Known issues1 open
Public security, privacy and governance advisories that are still open. Each row carries a source link — these are factual claims, not editorial judgements.
2026-05-05
lowUpstream change on bolt-new: github_last_push None → '2024-12-17T06:29:27Z', cve_count None → 0
other · open
Source ↗Data flow & telemetry
How Bolt.new moves data between the client, the inference endpoint and any vendor-owned services.
Data flow
- Direction
- direct_to_vendor
- Stores prompts
- Yes
Telemetry
- Collects telemetry
- true
- Privacy policy
- https://stackblitz.com/privacy-policy
Vendor & licensing
- Developer
- StackBlitz
- Vendor country
- US
- Vendor type
- startup
- Funding status
- vc_funded
- Runtime type
- web_app
- Open source
- Yes
- Licence
- MIT
- Licence risk
- permissive
- CLOUD Act exposure
- Yes
Security & maintenance health
Security profile
- Bug Bounty
- false
- Auto Update
- true