For apps built with Lovable, Bolt, Cursor, Replit and v0

Is your AI-built app leaking?

Your AI tool built it fast. AppLeakWatch keeps checking it, with over 90 checks for exposed API keys, open customer data and leaked files, then gives you a prompt to fix each problem.

Start your 7-day trial

7-day trial. We only scan sites you own.

Example reportmyapp.com
CriticalSupabase service role key is visible in your public code
CriticalAnyone can read the "profiles" table
High/api/users returns data without signing in
MediumStorage bucket "uploads" is public

What it checks

The mistakes AI tools leave behind

Your app can work perfectly and still hand your data to anyone who looks.

Exposed secrets

Over 20 kinds of key and credential, including Stripe, OpenAI, Anthropic, AWS, GitHub and database passwords.

Open databases

Supabase tables, storage and signup settings, plus Firebase Realtime Database, Firestore and Storage.

Files left online

Over 25 risky files, including .env, .git, SQL dumps, SQLite databases and private keys.

Open endpoints

APIs with no login, debug pages, GraphQL introspection, unsafe CORS and open redirects.

HTTPS and browser protection

Certificates, TLS versions, security headers and cookie settings.

Email spoofing

SPF and DMARC records that stop strangers sending email as you.

Code leftovers

Published source maps, test keys on live sites, localhost addresses and secret-looking settings.

A clear grade

A letter grade and every check we ran, so you can see exactly what passed.

New problems

On paid plans, each scan is compared with the last, and we email you when something new appears.

Works with your AI tool

Made for vibe-coded apps

Scans run from the outside, so it works with whatever built your app, including any public website.

How it works

Three steps, no security knowledge needed

  1. Add your app

    Enter your domain and sign in with a link sent to your email.

  2. Prove you own it

    Paste one prompt into your AI tool and publish. It takes about a minute.

  3. Get your report

    See your grade, what's exposed and why it matters. Paid plans add fix prompts for your AI tool.

Questions

Before you scan

Is the scan safe for my app?

Yes. Scans only read public addresses and never change anything. Each scan is limited to a set number of requests.

What do you keep from my app?

Only the type of problem and where it was found. For exposed keys we keep the first few characters. We don't store rows from your database.

What doesn't it check?

Scans run from outside your app. They don't test login flows, business logic or your source code, and they can't prove an app is secure.

Is a person involved?

No. AppLeakWatch is automated software, and no human services are included in any plan.

Find out what your app is showing the world

Start your 7-day trial