AppLeakWatch
Security scanner for apps built with Cursor
Cursor writes code quickly, and you still own what ships. AppLeakWatch checks the deployed result, so you catch what slipped past review.
What usually goes wrong
Endpoints with no login
Generated API routes can work perfectly and still skip the check for who's asking.
Published source maps
Production source maps can hand your original code to anyone who asks.
Files that shouldn't deploy
A stray .env or database dump can end up on a public server.
What else we check
- API keys for Stripe, OpenAI, Anthropic, AWS and others in your public code
- Downloadable .env, .git and database backup files
- API addresses that return data without a login
- SPF and DMARC records that stop people faking your email
- HTTPS redirects, certificates and browser security headers
How it works
Add your domain, prove you own it with one small change, and get a report with a letter grade and every check we ran. Scans only read public addresses and never change anything. No scan can prove an app is secure, but it can find the mistakes strangers look for first.