Use case
AI App Security Scan
AI-built apps have a specific set of security risks that traditional scanners miss: exposed provider keys, direct browser API calls, and unauthenticated generation endpoints. GetLeaked checks for these mistakes against your public app surface before they reach paying customers or security researchers.
The problem with AI apps built for speed
Lovable, Bolt, v0, and Cursor generate working code fast. They also generate code with patterns that cause security problems when exposed publicly: API keys hardcoded into components, fetch calls that go directly to OpenAI from the browser, and generation routes with no auth check.
These are not subtle vulnerabilities. An OpenAI key in a client bundle can be extracted in under 60 seconds by anyone who opens DevTools. A /api/chat route without an auth check is one curl command away from running up your bill. GetLeaked finds these before customers or bad actors do.
What GetLeaked checks
Four AI-specific risks, checked in minutes.
01
Exposed OpenAI and Anthropic API keys
If your OpenAI or Anthropic key lands in a client bundle or public page, anyone can extract it, run completions on your bill, and exhaust your quota in minutes. GetLeaked checks your page, every same-origin bundle it loads, and declared source maps for OpenAI and Anthropic key formats, alongside 18 other credential patterns.
02
NEXT_PUBLIC_ variables that look like secrets
Anything prefixed NEXT_PUBLIC_ ships to the browser. GetLeaked reads the variable names in __NEXT_DATA__ and flags the ones that look like keys or tokens, so you can move them server-side. Only the name is reported, never the value.
03
Source maps that rebuild your code
A public source map turns your minified bundle back into readable source, including any key you thought was hidden. GetLeaked downloads the maps your bundles declare and re-scans the original sources for secrets.
04
Open API routes (Deep Scan, owner-verified)
An API route without auth is an open tap. On a site you have verified you own, Deep Scan requests up to 20 same-origin API routes it finds in your HTML and JS without credentials, and flags any that return JSON data.
Scope and limitations
GetLeaked is explicit about what it cannot prove so you know when a deeper review is needed.
- Server-side API keys that never reach the client bundle are outside the scan scope.
- The free scan checks the public surface only. Repository scan is planned for v1.1; today’s Deep Scan expands public-deployment review.
- GetLeaked is static analysis — it cannot simulate authenticated or logged-in user flows.
Scan your AI app before someone else does.
Paste your public URL and get evidence of exposed keys and risky AI call patterns in minutes. Free, no login required.