About
LeakWatch is a free, read-only passive security scanner for apps built with AI tools like Lovable, Bolt and Cursor. Paste a public URL and it fetches the page and the scripts it loads, the way a browser does, then checks for exposed .env and .git files, credential-shaped secrets in JavaScript, Supabase tables readable with the public key, unauthenticated Firebase reads, missing security headers, cookie flags, CORS misconfiguration and SSL certificate expiry. It only sends GET requests: no logins, no form posts, no exploit payloads. The free scan shows every finding's title and severity. Paid plans (Starter $9/month for 1 monitored app, Pro $29/month for 10) add full evidence, copy-paste fix prompts and ongoing monitoring. Built by Richlabs in Canada. Not a pen test and not affiliated with Lovable, Bolt, Cursor or Supabase.