Use case
AI app security check for fast builders
AI builders ship quickly. GetLeaked checks the launch-risk mistakes that can hide in generated apps: exposed keys, leaked .env and .git files, open admin and debug paths, and missing security headers.
What GetLeaked checks for AI-built apps
- API keys exposed in client bundles, loaded source maps, or public page responses.
- Supabase service_role keys, confirmed by decoding the token.
- Public .env and .git files, and admin, dashboard or debug paths without an auth redirect.
- On Deep Scan, for a site you have verified you own: same-origin API routes that return data without credentials, and a read-only Supabase table check.
Why this matters before launch
Generated apps can look finished while still exposing secrets or open endpoints. GetLeaked gives you a plain-English report before you post the link publicly.
Supported builder paths
Lovable and Bolt.new apps
Check deployed web apps for public client-bundle exposure and common no-code launch risks.
Cursor, v0, and Replit builds
Review Next.js/React app patterns before the first public traffic spike.
Supabase and Firebase backends
Surface signs that auth, RLS, or client configuration deserve immediate attention.
Common questions
Do I need a security background?
No. The report is written for builders and includes evidence plus specific fixes.
Can GetLeaked scan private repos?
Not in the current public flow. The current scan accepts public URLs; any future repository review will require an explicit repo input and handling terms.
Is this a penetration test?
No. It is a static launch-risk scan, not a full penetration test.
Check before you ship
GetLeaked scans public URLs for launch-risk signals. It is static analysis, not a full penetration test.
Scan my app free →