A real report, on our own site
This is what AppLeakWatch reports for appleakwatch.shinobitech.dev. It's the real scanner, not a mock-up, and it reruns every day. Last scan: November 2, 2026 at 11:53 PM UTC.
A
0 issues found. 95 checks passed, 0 failed and 13 didn't apply.
A clean report doesn't prove a site is secure. Scans run from the outside and can't test login flows, business logic or source code.
HTTPS and certificates
- ✓HTTP redirects to HTTPS
- ✓Browsers are told to always use HTTPS
- ✓Certificate is valid
- ✓Certificate isn't about to expire
- ✓Modern TLS version
Browser protection
- ✓Content-Security-Policy is set
- ✓Content-Security-Policy blocks inline scripts
- ✓Other sites can't embed your pages
- ✓Browsers don't guess file types
- ✓Referrer-Policy is set
- ✓Permissions-Policy is set
- ✓Server software version isn't advertised
Cookies and sessions
- –Cookies are HTTPS onlyYour homepage doesn't set cookies
- –Cookies are hidden from scriptsYour homepage doesn't set cookies
- –Cookies have cross-site protectionYour homepage doesn't set cookies
Files left online
- ✓/.env isn't downloadable
- ✓/.env.local isn't downloadable
- ✓/.env.production isn't downloadable
- ✓/.env.development isn't downloadable
- ✓/.env.backup isn't downloadable
- ✓/.env.bak isn't downloadable
- ✓/.git/config isn't downloadable
- ✓/.git/HEAD isn't downloadable
- ✓/.npmrc isn't downloadable
- ✓/.aws/credentials isn't downloadable
- ✓/.ssh/id_rsa isn't downloadable
- ✓/id_rsa isn't downloadable
- ✓/.htpasswd isn't downloadable
- ✓/.vscode/sftp.json isn't downloadable
- ✓/backup.sql isn't downloadable
- ✓/dump.sql isn't downloadable
- ✓/database.sql isn't downloadable
- ✓/db.sql isn't downloadable
- ✓/db.sqlite isn't downloadable
- ✓/database.sqlite isn't downloadable
- ✓/docker-compose.yml isn't downloadable
- ✓/wp-config.php.bak isn't downloadable
- ✓/config.php.bak isn't downloadable
- ✓/phpinfo.php isn't downloadable
- ✓/.DS_Store isn't downloadable
- ✓/npm-debug.log isn't downloadable
- ✓/firebase-debug.log isn't downloadable
- ✓/uploads/ doesn't list its files
- ✓/backup/ doesn't list its files
- ✓/backups/ doesn't list its files
- ✓/files/ doesn't list its files
Secrets in your public code
- ✓Stripe or Clerk live secret key not exposed
- ✓Paddle live API key not exposed
- ✓OpenAI API key not exposed
- ✓Anthropic API key not exposed
- ✓Google AI or Cloud API key not exposed
- ✓Groq API key not exposed
- ✓xAI API key not exposed
- ✓Hugging Face token not exposed
- ✓Replicate API token not exposed
- ✓AWS access key not exposed
- ✓GitHub token not exposed
- ✓Slack token not exposed
- ✓Slack webhook not exposed
- ✓Discord webhook not exposed
- ✓Telegram bot token not exposed
- ✓SendGrid API key not exposed
- ✓Resend API key not exposed
- ✓Mailgun API key not exposed
- ✓Twilio API key not exposed
- ✓Google OAuth client secret not exposed
- ✓Cloudinary URL with secret not exposed
- ✓Supabase secret key not exposed
- ✓Private key not exposed
- ✓Database address with password not exposed
- ✓Supabase service role key not exposed
Code quality signals
- ✓No secret-looking settings in browser code
- ✓No localhost addresses left in
- ✓No test payment keys on the live site
- ✓Page doesn't load scripts over plain HTTP
- ✓Original source code isn't published
Database and storage
- –Supabase tables need a loginNo Supabase project found in your public code
- –Supabase storage is privateNo Supabase project found in your public code
- –Supabase signups need email confirmationNo Supabase project found in your public code
- –Firebase database needs a loginNo Firebase project found in your public code
- –Firestore needs a loginNo Firebase project found in your public code
- –Firebase storage can't be listedNo Firebase project found in your public code
Open endpoints
- ✓/api/users needs a login
- ✓/api/v1/users needs a login
- ✓/api/customers needs a login
- ✓/api/accounts needs a login
- ✓/api/admin needs a login
- ✓/api/orders needs a login
- ✓/api/payments needs a login
- ✓/api/invoices needs a login
- ✓/api/export needs a login
- ✓/users.json needs a login
- ✓/actuator/env isn't public
- ✓/debug/vars isn't public
- ✓/server-status isn't public
- ✓/swagger.json isn't public
- ✓/openapi.json isn't public
- ✓/api-docs isn't public
- ✓GraphQL doesn't describe itself to strangers
- ✓Other websites can't read logged-in responses
- ✓?redirect= can't send visitors elsewhere
- ✓?next= can't send visitors elsewhere
- ✓?url= can't send visitors elsewhere
- ✓?returnTo= can't send visitors elsewhere
Email spoofing protection
- –SPF record is setEmail records belong to your main domain, so this subdomain wasn't checked
- –SPF doesn't allow every senderEmail records belong to your main domain, so this subdomain wasn't checked
- –DMARC record is setEmail records belong to your main domain, so this subdomain wasn't checked
- –DMARC blocks fake emailEmail records belong to your main domain, so this subdomain wasn't checked