What does GetLeaked check?

GetLeaked checks the public surface of your app for exposed API keys (OpenAI, Anthropic, Stripe, AWS, GitHub, Supabase service_role, and more) in your page, bundles and declared source maps, exposed .env and .git files, open admin and debug paths, GraphQL introspection, missing security headers, insecure cookies, and CORS that reflects any origin.

What is the difference between the Free URL Scan and the Deep Scan?

The Free URL Scan inspects what is already publicly visible — your public page response, client-side JavaScript bundles, and inline targets. Deep Scan is coming soon. Deep Scan runs every free-scan check, then, on a site you have verified you own, adds read-only active checks: an unauthenticated same-origin API sweep and, when your bundle exposes a matching Supabase URL and anon key, a Supabase read check that counts the rows each table returns to the anon key and lists the storage buckets it can see, with an SQL fix for each gap. Found keys are never used, sent or stored; each OpenAI, Anthropic, Stripe or GitHub key is reported as exposed, rotate now, with that provider's rotation steps. It gives each credential a redacted fingerprint and produces a Markdown report you can share.

Does GetLeaked replace a formal security audit or pentest?

No. GetLeaked provides fast static evidence for the most common builder mistakes before launch. It is a proof step, not a penetration test. Every report explicitly states what the scan covered and what it cannot prove — so you know exactly where the gaps are.

What data does GetLeaked store and for how long?

Scan inputs and results are stored for 30 days and then permanently deleted. We do not share scan data with third parties and do not use it to train models. Secrets found during a scan are redacted before findings leave the scan engine.

When will Deep Scan be available?

Deep Scan is coming soon. It is not on sale yet, so there is nothing to buy today. The Free URL Scan stays free.

Can the free scan see my server-side environment variables?

No. The free URL scan can only inspect what is publicly accessible: your page HTML, loaded JavaScript bundles, and inline targets visible from the scanned URL. Server-side environment variables that never reach the client are outside the scope of both the free scan and Deep Scan.

No upload required. Your files stay on your machine.

Public exposure scan for AI-built apps

Your vibe-coded app might be leaking keys.

GetLeaked scans Lovable, Bolt, Cursor, Next.js, and Supabase apps for the security mistakes fast AI builds often miss: exposed API keys, public client secrets, exposed .env and .git files, source maps, missing security headers, and open debug routes.

Checks 20 credential patterns across OpenAI, Anthropic, Stripe, AWS, GitHub, Supabase, Firebase, and more.

Ownership proof required before a scan

Clear scope notes on every report

Secrets redacted before findings leave the scan engine

See what gets checked

Why teams use this before launch

A simple proof step before you share the app.

Security buyers and technical founders do not need more vague badges. They need a quick way to verify whether the public app already reveals enough to lose trust.

Scan the public surface

We inspect what an attacker can already see, including page responses, client bundles, and inline targets.

Return evidence with context

Every finding shows what was seen, why it matters, and what this free scan cannot prove.

Escalate only when justified

If the quick scan shows real risk, Deep Scan expands public-surface coverage and remediation.

Built for trust-sensitive launches

Useful for teams shipping with Lovable, Bolt, Cursor, v0, Next.js, Supabase, and Firebase, especially before demos, launches, or paid traffic.

Next.js

Supabase

Firebase

Vercel

What it checks

Six checks, chosen for real launch risk.

These are the failures that quietly leak trust, budget, or data while the app still appears to work.

Exposed API keys

OpenAI, Anthropic, Stripe, AWS, GitHub and 15 more key patterns in your page, bundles and source maps.

Supabase service_role key

The key that bypasses Row Level Security, confirmed by decoding the token, not just matching its shape.

Exposed .env and .git

Public /.env, /.env.local, /.env.production and /.git files, reported by size and type, never by content.

Open admin and debug paths

/admin, /dashboard, /debug and /graphql reachable without an auth redirect, plus GraphQL introspection.

Source maps

Declared .map files that rebuild your original source, re-scanned for secrets.

Headers, cookies and CORS

Missing security headers, cookies without Secure/HttpOnly/SameSite, and reflected CORS origins.

Sample finding

OpenAI key in client bundle

Critical

Evidence: sk-proj-**** found in _next/static/chunks/app

Fix: Move to server-side env, add to .env.local

How it works

Fast enough for launch day, clear enough for non-security teams.

Paste a URL or repo

Leaked scans the public surface or source tree depending on what you share.

Get evidence, not guesswork

Every finding includes the exact risky pattern and the line of reasoning behind it.

Fix the trust leak fast

You leave with plain-English remediation steps, not a pile of generic security jargon.

Built for founders who need a fast security proof step before they ask others to trust the app.

Especially useful for AI-built apps shipped with Lovable, Bolt.new, v0, Cursor, Next.js, Supabase, and Firebase.

Feature comparison

What Deep Scan adds over the free scan. Coming soon.

Feature	Free	Deep Scan (coming soon)
Public page and bundle inspection
Plain-English findings
Source-map download & secret re-scan Only source maps your bundles declare are fetched; the original sources are re-scanned for secrets.
All 20 secret patterns, incl. Supabase service_role
Security headers, cookies and CORS
Exposed .env, .git, admin and debug paths In Deep Scan these requests, like GraphQL and robots.txt, run only on a site you verified you own in the last 24 hours.
GraphQL introspection and robots.txt
Credentials reported with a redacted fingerprint Found keys are never used, sent or stored. OpenAI, Anthropic, Stripe and GitHub keys are marked exposed, rotate now, with that provider's rotation steps.
Unauthenticated API route sweep (owner-verified) Up to 20 same-origin API routes found in your HTML and JS are requested without credentials; any that return JSON data are flagged. Runs only on a site you verified you own in the last 24 hours.
Supabase table and storage read check, with SQL fixes (owner-verified) Opt-in: when your bundle exposes a Supabase URL and a matching anon key, and you prove you control that project by running a one-line SQL snippet in it (a function that returns a token GetLeaked issues for you), counts the rows each of up to 20 tables returns to that key and lists the storage buckets it can see. GET and HEAD only; only names, status and counts are kept. Tables that give no usable answer are reported as inconclusive. Each gap comes with SQL that lists the table's policies, drops permissive anon reads and adds an example owner policy; policy review is required.
Fix pack: Lovable, Bolt and Cursor prompts, SQL and header config Per finding: steps, a copy-paste prompt for each builder, SQL for Supabase gaps, next.config.js / vercel.json / Netlify headers, and a template that moves a leaked key into a server route. Prompts never include a key.
Downloadable Markdown report Every finding points to the page, bundle, source map, route or table that triggered it.
Shareable read-only report link Report says what was checked and what was not checked, so there is no fake certainty.
One free re-scan within 30 days
Email summary The report links are emailed to the address you give at checkout.

Free

Public page and bundle inspection
Plain-English findings
Source-map download & secret re-scan
All 20 secret patterns, incl. Supabase service_role
Security headers, cookies and CORS
Exposed .env, .git, admin and debug paths
GraphQL introspection and robots.txt
Credentials reported with a redacted fingerprint
Unauthenticated API route sweep (owner-verified)
Supabase table and storage read check, with SQL fixes (owner-verified)
Fix pack: Lovable, Bolt and Cursor prompts, SQL and header config
Downloadable Markdown report
Shareable read-only report link
One free re-scan within 30 days
Email summary

Deep Scan

Coming soon

Public page and bundle inspection
Plain-English findings
Source-map download & secret re-scan
Only source maps your bundles declare are fetched; the original sources are re-scanned for secrets.
All 20 secret patterns, incl. Supabase service_role
Security headers, cookies and CORS
Exposed .env, .git, admin and debug paths
In Deep Scan these requests, like GraphQL and robots.txt, run only on a site you verified you own in the last 24 hours.
GraphQL introspection and robots.txt
Credentials reported with a redacted fingerprint
Found keys are never used, sent or stored. OpenAI, Anthropic, Stripe and GitHub keys are marked exposed, rotate now, with that provider's rotation steps.
Unauthenticated API route sweep (owner-verified)
Up to 20 same-origin API routes found in your HTML and JS are requested without credentials; any that return JSON data are flagged. Runs only on a site you verified you own in the last 24 hours.
Supabase table and storage read check, with SQL fixes (owner-verified)
Opt-in: when your bundle exposes a Supabase URL and a matching anon key, and you prove you control that project by running a one-line SQL snippet in it (a function that returns a token GetLeaked issues for you), counts the rows each of up to 20 tables returns to that key and lists the storage buckets it can see. GET and HEAD only; only names, status and counts are kept. Tables that give no usable answer are reported as inconclusive. Each gap comes with SQL that lists the table's policies, drops permissive anon reads and adds an example owner policy; policy review is required.
Fix pack: Lovable, Bolt and Cursor prompts, SQL and header config
Per finding: steps, a copy-paste prompt for each builder, SQL for Supabase gaps, next.config.js / vercel.json / Netlify headers, and a template that moves a leaked key into a server route. Prompts never include a key.
Downloadable Markdown report
Every finding points to the page, bundle, source map, route or table that triggered it.
Shareable read-only report link
Report says what was checked and what was not checked, so there is no fake certainty.
One free re-scan within 30 days
Email summary
The report links are emailed to the address you give at checkout.

Free is for triage. Deep Scan is for evidence you can act on (or hand to someone else).

Paid scans temporarily unavailable.

Pricing

Simple pricing for fast triage and deeper remediation.

Free URL Scan

$0per scan

Fast public-surface triage before a launch, demo, or customer share.

Public page and bundle inspection
Secret check: 20 key patterns, including Supabase service_role
Security headers, cookies and CORS
Exposed .env, .git, admin and debug paths
Source maps, GraphQL introspection and robots.txt
Instant JSON report

Safe to scan. Honest about scope.

GetLeaked is designed for early builders who need security clarity without handing over their whole company. The free scan checks publicly accessible URLs and bundles — the same surface anyone on the internet can request. Deep Scan adds passive credential checks that stay on the page, auth-bypass probes, source-map reconstruction where exposed, and a clearer remediation report.

Free URL scan: checks public app surfaces only. No login required.
No code execution: GetLeaked analyzes exposed files and patterns; it does not run your app code.
Plain-English evidence: findings include the signal, why it matters, and the first fix to make.
Clear limits: reports state what was scanned and what was out of scope.
Not a pentest: this reduces launch risk; it does not replace a full security audit for mature production systems.

For Deep Scan, submit only a public URL you own or are authorized to test. Do not paste credentials, private tokens, or secrets into the scan form. Repository review is not included unless a future flow explicitly collects repo access and states the handling terms.

Built by Crescent Labs — security-first AI systems, shipped in public.

Limitations

What Leaked does not check.

We stay explicit about scope so builders know when they need a wider audit.

Server-side environment variables that never reach the client bundle, public responses, or exposed source maps.
Full Git history, because current scanning is focused on the present code state.
Infrastructure, networking, IAM, or DNS misconfigurations outside app code.
Mobile apps and non-web stacks outside the supported Next.js, Supabase, and Firebase scope.
Runtime exploit chains. The current product focuses on static evidence and exposed patterns.

FAQ

Common questions.

What does GetLeaked check?: GetLeaked checks the public surface of your app for exposed API keys (OpenAI, Anthropic, Stripe, AWS, GitHub, Supabase service_role, and more) in your page, bundles and declared source maps, exposed .env and .git files, open admin and debug paths, GraphQL introspection, missing security headers, insecure cookies, and CORS that reflects any origin.
What is the difference between the Free URL Scan and the Deep Scan?: The Free URL Scan inspects what is already publicly visible — your public page response, client-side JavaScript bundles, and inline targets. Deep Scan is coming soon. Deep Scan runs every free-scan check, then, on a site you have verified you own, adds read-only active checks: an unauthenticated same-origin API sweep and, when your bundle exposes a matching Supabase URL and anon key, a Supabase read check that counts the rows each table returns to the anon key and lists the storage buckets it can see, with an SQL fix for each gap. Found keys are never used, sent or stored; each OpenAI, Anthropic, Stripe or GitHub key is reported as exposed, rotate now, with that provider's rotation steps. It gives each credential a redacted fingerprint and produces a Markdown report you can share.
Does GetLeaked replace a formal security audit or pentest?: No. GetLeaked provides fast static evidence for the most common builder mistakes before launch. It is a proof step, not a penetration test. Every report explicitly states what the scan covered and what it cannot prove — so you know exactly where the gaps are.
What data does GetLeaked store and for how long?: Scan inputs and results are stored for 30 days and then permanently deleted. We do not share scan data with third parties and do not use it to train models. Secrets found during a scan are redacted before findings leave the scan engine.
When will Deep Scan be available?: Deep Scan is coming soon. It is not on sale yet, so there is nothing to buy today. The Free URL Scan stays free.
Can the free scan see my server-side environment variables?: No. The free URL scan can only inspect what is publicly accessible: your page HTML, loaded JavaScript bundles, and inline targets visible from the scanned URL. Server-side environment variables that never reach the client are outside the scope of both the free scan and Deep Scan.

Ship the product, not the security mistake.

Run the free URL scan for a public-surface check, then use Deep Scan when you need deeper public-deployment confidence before a launch, client share, or investor demo.