PlugLeak

PlugLeak is a free, passive security check for apps built with Lovable, Bolt, Cursor and Supabase. Paste your app's URL and in about 20 seconds it reads your live HTML and every JavaScript chunk, then flags leaked API keys (Supabase service_role, Stripe, OpenAI, Anthropic, AWS), exposed .env/.git files, missing security headers and HTTPS problems, with a score out of 100. GET requests only, no logins or exploits, and secrets are masked. The score is free; a $9 fix report adds a paste-ready fix prompt for each issue.