AppLeakWatch
Exposed API key scanner
A leaked key can mean surprise bills or stolen data. AppLeakWatch reads the code your site sends to every visitor and looks for over 20 kinds of secret.
What usually goes wrong
AI provider keys
OpenAI, Anthropic, Groq and similar keys can be used to run up your bill.
Payment and cloud keys
Stripe, AWS and GitHub credentials can give direct access to money or infrastructure.
Database addresses
A connection string with a password can hand over your entire database.
What else we check
- API keys for Stripe, OpenAI, Anthropic, AWS and others in your public code
- Downloadable .env, .git and database backup files
- API addresses that return data without a login
- SPF and DMARC records that stop people faking your email
- HTTPS redirects, certificates and browser security headers
How it works
Add your domain, prove you own it with one small change, and get a report with a letter grade and every check we ran. Scans only read public addresses and never change anything. No scan can prove an app is secure, but it can find the mistakes strangers look for first.
More scanners
- Security scanner for Lovable apps
- Security scanner for Bolt apps
- Security scanner for apps built with Cursor
- Security scanner for Replit apps
- Security scanner for apps built with v0
- Security scanner for apps built with Windsurf
- Security scanner for Base44 apps
- Supabase RLS checker
- Firebase security rules checker