LeakPatrol0/100
What we found
Get every fix
The full report explains each problem in plain English and gives you a copy-paste prompt to fix it in Lovable, Bolt, Cursor or Claude Code.
One-off payment, no subscription. Secure checkout by Lemon Squeezy. Your report re-checks your site whenever you open it.
Full reports are coming soon. Leave your email and we'll tell you when they're ready.
One email when full reports launch, nothing else. Unsubscribe any time.
How it works
From worried to fixed in three steps
-
1
Paste your address
Your live app's URL, like
myapp.lovable.app. No account, no code access, nothing to install. -
2
Get your grade
We look at your app the way an attacker's browser would, and list every problem from most to least serious.
-
3
Paste the fixes
Each fix comes with a prompt you paste straight into the AI tool that built your app. Scan again to watch your grade go up.
What we check
The mistakes AI tools make most
Leaked secrets
OpenAI, Anthropic, Stripe, AWS, GitHub and Supabase service keys hiding in your JavaScript, where anyone can copy them and run up your bill.
Supabase setup
Admin keys shipped to the browser and, once you verify you own the site, which tables anyone can read without logging in.
Exposed files
Public .env files, .git folders and source maps that hand over your passwords and your code.
Security headers & HTTPS
The browser protections most AI-built apps are missing, with the exact lines to add for your host.
Pricing
Free to check. £9 to fix everything.
Free scan
£0
- Your A–F grade and score
- Every problem we find, by severity
- One worked example fix
Full report Coming soon
£9 one-off
- Every fix in plain English
- A copy-paste prompt for your AI tool, for each one
- Supabase database check for verified owners
- Re-checks your site every time you open it
- Download as Markdown
Questions
Good to know
Is it safe to scan my app?
Yes. We only download what any visitor's browser already downloads, plus a short list of files that should never be public. We never log in, submit forms, or change or delete anything.
Do you store my keys or data?
No. If we find a key we show only the first and last few characters, and we never store the full value. Scan results are kept for 10 minutes so repeat scans are quick.
Can I scan someone else's app?
Only scan apps you own or have permission to test. The database check only runs after you prove you own the site.
My app was built with Lovable. Will the fixes work there?
Yes. Each fix in the full report comes with a prompt written for AI coding tools, so you can paste it into Lovable, Bolt, v0, Replit, Cursor or Claude Code.
I got an A. Am I completely safe?
An A means none of the common, visible mistakes we look for. It is not a full security audit, so keep following good practice, especially around who can read and change your data.