Pricing
Simple pricing for fast triage and deeper remediation.
Free for public-surface checks. Deep Scan is coming soon, with owner-verified active checks (API route sweep and Supabase read check), source-map reconstruction, and a report you can hand to someone else.
Free URL Scan
Fast public-surface triage before a launch, demo, or customer share.
- Public page and bundle inspection
- Secret check: 20 key patterns, including Supabase service_role
- Security headers, cookies and CORS
- Exposed .env, .git, admin and debug paths
- Source maps, GraphQL introspection and robots.txt
- Instant JSON report
Deep Scan
For founders who are about to launch, take payments, connect Supabase, or put an AI endpoint in front of real users.
- Everything in the free scan: all 20 secret patterns, security headers, cookies, CORS, exposed .env/.git/admin/debug paths, GraphQL introspection, robots.txt and source maps.
- Owner-verified API sweep: requests up to 20 same-origin API routes found in your HTML and JS without credentials and flags any that return JSON data.
- Supabase read check: when your bundle exposes a Supabase URL and a matching anon key, counts how many rows each of up to 20 tables returns to that public key and lists the storage buckets it can see, each with a copy-paste SQL fix. Read-only (GET and HEAD); only names, status and counts are kept, never row contents.
- Source-map reconstruction: downloads the source maps your bundles declare and re-scans the original sources for secrets.
- Credential findings with a redacted value and fingerprint. Found keys are never used, sent or stored: each OpenAI, Anthropic, Stripe or GitHub key is marked exposed, rotate now, with that provider's rotation steps.
- Supabase anon key and Firebase or Supabase project references flagged for review.
- Fix pack: for each finding, copy-paste prompts for Lovable, Bolt and Cursor, SQL for Supabase gaps, security-header config for Next.js, Vercel and Netlify, and a template for moving a leaked key server-side.
- Evidence included: every finding points to the page, bundle, source map, route or table that triggered it.
- Scope statement: the report says what was checked and what was not checked, so there is no fake certainty.
- Markdown report, a shareable read-only link, and one re-scan within 30 days.
Paid scans temporarily unavailable.
Feature comparison
What Deep Scan adds over the free scan. Coming soon.
| Feature | Free | Deep Scan (coming soon) |
|---|---|---|
| Public page and bundle inspection | ||
| Plain-English findings | ||
Source-map download & secret re-scanOnly source maps your bundles declare are fetched; the original sources are re-scanned for secrets. | ||
| All 20 secret patterns, incl. Supabase service_role | ||
| Security headers, cookies and CORS | ||
Exposed .env, .git, admin and debug pathsIn Deep Scan these requests, like GraphQL and robots.txt, run only on a site you verified you own in the last 24 hours. | ||
| GraphQL introspection and robots.txt | ||
Credentials reported with a redacted fingerprintFound keys are never used, sent or stored. OpenAI, Anthropic, Stripe and GitHub keys are marked exposed, rotate now, with that provider's rotation steps. | ||
Unauthenticated API route sweep (owner-verified)Up to 20 same-origin API routes found in your HTML and JS are requested without credentials; any that return JSON data are flagged. Runs only on a site you verified you own in the last 24 hours. | ||
Supabase table and storage read check, with SQL fixes (owner-verified)Opt-in: when your bundle exposes a Supabase URL and a matching anon key, and you prove you control that project by running a one-line SQL snippet in it (a function that returns a token GetLeaked issues for you), counts the rows each of up to 20 tables returns to that key and lists the storage buckets it can see. GET and HEAD only; only names, status and counts are kept. Tables that give no usable answer are reported as inconclusive. Each gap comes with SQL that lists the table's policies, drops permissive anon reads and adds an example owner policy; policy review is required. | ||
Fix pack: Lovable, Bolt and Cursor prompts, SQL and header configPer finding: steps, a copy-paste prompt for each builder, SQL for Supabase gaps, next.config.js / vercel.json / Netlify headers, and a template that moves a leaked key into a server route. Prompts never include a key. | ||
Downloadable Markdown reportEvery finding points to the page, bundle, source map, route or table that triggered it. | ||
Shareable read-only report linkReport says what was checked and what was not checked, so there is no fake certainty. | ||
| One free re-scan within 30 days | ||
Email summaryThe report links are emailed to the address you give at checkout. |
Free
$0
- Public page and bundle inspection
- Plain-English findings
- Source-map download & secret re-scan
- All 20 secret patterns, incl. Supabase service_role
- Security headers, cookies and CORS
- Exposed .env, .git, admin and debug paths
- GraphQL introspection and robots.txt
- Credentials reported with a redacted fingerprint
- Unauthenticated API route sweep (owner-verified)
- Supabase table and storage read check, with SQL fixes (owner-verified)
- Fix pack: Lovable, Bolt and Cursor prompts, SQL and header config
- Downloadable Markdown report
- Shareable read-only report link
- One free re-scan within 30 days
- Email summary
Deep Scan
Coming soon
- Public page and bundle inspection
- Plain-English findings
Source-map download & secret re-scan
Only source maps your bundles declare are fetched; the original sources are re-scanned for secrets.
- All 20 secret patterns, incl. Supabase service_role
- Security headers, cookies and CORS
Exposed .env, .git, admin and debug paths
In Deep Scan these requests, like GraphQL and robots.txt, run only on a site you verified you own in the last 24 hours.
- GraphQL introspection and robots.txt
Credentials reported with a redacted fingerprint
Found keys are never used, sent or stored. OpenAI, Anthropic, Stripe and GitHub keys are marked exposed, rotate now, with that provider's rotation steps.
Unauthenticated API route sweep (owner-verified)
Up to 20 same-origin API routes found in your HTML and JS are requested without credentials; any that return JSON data are flagged. Runs only on a site you verified you own in the last 24 hours.
Supabase table and storage read check, with SQL fixes (owner-verified)
Opt-in: when your bundle exposes a Supabase URL and a matching anon key, and you prove you control that project by running a one-line SQL snippet in it (a function that returns a token GetLeaked issues for you), counts the rows each of up to 20 tables returns to that key and lists the storage buckets it can see. GET and HEAD only; only names, status and counts are kept. Tables that give no usable answer are reported as inconclusive. Each gap comes with SQL that lists the table's policies, drops permissive anon reads and adds an example owner policy; policy review is required.
Fix pack: Lovable, Bolt and Cursor prompts, SQL and header config
Per finding: steps, a copy-paste prompt for each builder, SQL for Supabase gaps, next.config.js / vercel.json / Netlify headers, and a template that moves a leaked key into a server route. Prompts never include a key.
Downloadable Markdown report
Every finding points to the page, bundle, source map, route or table that triggered it.
Shareable read-only report link
Report says what was checked and what was not checked, so there is no fake certainty.
- One free re-scan within 30 days
Email summary
The report links are emailed to the address you give at checkout.
Free is for triage. Deep Scan is for evidence you can act on (or hand to someone else).
Paid scans temporarily unavailable.
FAQ
Common questions.
- Is the free URL Scan actually free?
- Yes. The free URL Scan checks your public app surface — page, bundles, source maps, headers, cookies and common exposed paths — at no cost. No login, no card, no wallet connection required. Automated abuse or scanning systems you do not own can still be blocked under the terms.
- What is the Deep Scan and when is it available?
- Deep Scan is coming soon and is not on sale yet. Deep Scan runs every free-scan check, then, on a site you have verified you own, adds read-only active checks: an unauthenticated same-origin API sweep and, when your bundle exposes a matching Supabase URL and anon key, a Supabase read check that counts the rows each table returns to the anon key and lists the storage buckets it can see, with an SQL fix for each gap. Found keys are never used, sent or stored; each OpenAI, Anthropic, Stripe or GitHub key is reported as exposed, rotate now, with that provider's rotation steps. It gives each credential a redacted fingerprint and produces a Markdown report you can share.
- Does Deep Scan use the leaked keys it finds?
- No. Found credentials are never used: no request is sent to OpenAI, Anthropic, Stripe, GitHub or anyone else with it, and it is never stored. A key that ships to the browser is public, so each OpenAI, Anthropic, Stripe or GitHub key is reported as exposed, rotate now, with that provider's rotation steps and a fix-pack entry for moving it server-side. Only redacted values and fingerprints are kept.
- Will the Free URL Scan ever go away?
- No. The free public-surface check is designed to stay free for normal builder use. If any limit is introduced, this page will state it plainly before it affects normal scans.
- Can I buy a Deep Scan today?
- Not yet. Deep Scan is coming soon, and there is nothing to pay for today. The Free URL Scan needs no login and no card.