Is Supercharge for Bolt.new safe?

Medium risk

Supercharge for Bolt.new embeds API keys and sends scrape and search requests to Firecrawl and 21st.dev.

Supercharge for Bolt.new includes hardcoded Firecrawl and 21st.dev API credentials in its extension code. Its Bolt UI flows send page URLs to Firecrawl scrape and crawl endpoints, and its background worker proxies 21st.dev search and prompt requests with the embedded key.

Part of this rating comes from analysis signals we haven't published as detailed findings yet.

martin.slaneyv1.4.4Chrome Web Store
42Risk
Who publishes it

martin.slaney - no other listings under this identity

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
martin.slaney
Registered address
4 Monks Lane, Wadhurst TN5 6EW, GB
Registered contact
Martin Geoffrey Slaney

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

What it can do

Permissions this extension asks for, as declared in version 1.4.4. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on bolt.new

    https://bolt.new/* and 1 more

  • Read and change your data on local-credentialless.webcontainer-api.io

    https://*.local-credentialless.webcontainer-api.io/*

  • Read and change your data on bolt.ai

    https://*.bolt.ai/*

  • Read and change your data on bolt.diy

    https://*.bolt.diy/*

  • Read and change your data on bolt.dev

    https://*.bolt.dev/*

  • Read and change your data on 21st.dev

    https://21st.dev/*

  • Read and change your data on content-webcontainer.io

    https://content-webcontainer.io/*

  • Read and change your data on content.webcontainer.io

    https://content.webcontainer.io/*

  • Store data in your browser

    storage

  • Read and change cookies, including the ones that keep you signed in

    cookies

  • Act on the current tab, but only after you click the extension

    activeTab

  • Run its own code inside the pages you visit

    scripting

  • Schedule its own background tasks

    alarms

  • See the address and title of every tab you have open

    tabs

  • See every page you navigate to, as you navigate to it

    webNavigation

favicon

Where it sends data

Destinations our analysis observed Supercharge for Bolt.new contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • api.firecrawl.dev

    Supercharge for Bolt.new sends data to api.firecrawl.dev. One other extension we have analysed sends data here.

  • 21st.dev

    Supercharge for Bolt.new sends data to 21st.dev. No other extension we have analysed sends data here.

Updated 30 September 2026ledhmjoggdmddplpnaegbehbognlnaeo