Every check we run

AppLeakWatch runs 108 checks from outside your app. They only read public addresses and never change anything. This list is built from the scanner itself, so it always matches what runs.

Some checks only apply to certain apps. For example, Supabase table tests need a Supabase project in your public code. A scan also tests each Supabase table it can see, so your report can show more lines than this list. Your report shows which checks passed, failed or were skipped.

HTTPS and certificates (5)

• HTTP redirects to HTTPS
• Browsers are told to always use HTTPS
• Certificate is valid
• Certificate isn't about to expire
• Modern TLS version

Browser protection (7)

• Content-Security-Policy is set
• Content-Security-Policy blocks inline scripts
• Other sites can't embed your pages
• Browsers don't guess file types
• Referrer-Policy is set
• Permissions-Policy is set
• Server software version isn't advertised

Cookies and sessions (3)

• Cookies are HTTPS only
• Cookies are hidden from scripts
• Cookies have cross-site protection

Files left online (31)

• /.env isn't downloadable
• /.env.local isn't downloadable
• /.env.production isn't downloadable
• /.env.development isn't downloadable
• /.env.backup isn't downloadable
• /.env.bak isn't downloadable
• /.git/config isn't downloadable
• /.git/HEAD isn't downloadable
• /.npmrc isn't downloadable
• /.aws/credentials isn't downloadable
• /.ssh/id_rsa isn't downloadable
• /id_rsa isn't downloadable
• /.htpasswd isn't downloadable
• /.vscode/sftp.json isn't downloadable
• /backup.sql isn't downloadable
• /dump.sql isn't downloadable
• /database.sql isn't downloadable
• /db.sql isn't downloadable
• /db.sqlite isn't downloadable
• /database.sqlite isn't downloadable
• /docker-compose.yml isn't downloadable
• /wp-config.php.bak isn't downloadable
• /config.php.bak isn't downloadable
• /phpinfo.php isn't downloadable
• /.DS_Store isn't downloadable
• /npm-debug.log isn't downloadable
• /firebase-debug.log isn't downloadable
• /uploads/ doesn't list its files
• /backup/ doesn't list its files
• /backups/ doesn't list its files
• /files/ doesn't list its files

Secrets in your public code (25)

• Stripe or Clerk live secret key not exposed
• Paddle live API key not exposed
• OpenAI API key not exposed
• Anthropic API key not exposed
• Google AI or Cloud API key not exposed
• Groq API key not exposed
• xAI API key not exposed
• Hugging Face token not exposed
• Replicate API token not exposed
• AWS access key not exposed
• GitHub token not exposed
• Slack token not exposed
• Slack webhook not exposed
• Discord webhook not exposed
• Telegram bot token not exposed
• SendGrid API key not exposed
• Resend API key not exposed
• Mailgun API key not exposed
• Twilio API key not exposed
• Google OAuth client secret not exposed
• Cloudinary URL with secret not exposed
• Supabase secret key not exposed
• Private key not exposed
• Database address with password not exposed
• Supabase service role key not exposed

Code quality signals (5)

• No secret-looking settings in browser code
• No localhost addresses left in
• No test payment keys on the live site
• Page doesn't load scripts over plain HTTP
• Original source code isn't published

Database and storage (6)

• Supabase tables need a login
• Supabase storage is private
• Supabase signups need email confirmation
• Firebase database needs a login
• Firestore needs a login
• Firebase storage can't be listed

Open endpoints (22)

• /api/users needs a login
• /api/v1/users needs a login
• /api/customers needs a login
• /api/accounts needs a login
• /api/admin needs a login
• /api/orders needs a login
• /api/payments needs a login
• /api/invoices needs a login
• /api/export needs a login
• /users.json needs a login
• /actuator/env isn't public
• /debug/vars isn't public
• /server-status isn't public
• /swagger.json isn't public
• /openapi.json isn't public
• /api-docs isn't public
• GraphQL doesn't describe itself to strangers
• Other websites can't read logged-in responses
• ?redirect= can't send visitors elsewhere
• ?next= can't send visitors elsewhere
• ?url= can't send visitors elsewhere
• ?returnTo= can't send visitors elsewhere

Email spoofing protection (4)

• SPF record is set
• SPF doesn't allow every sender
• DMARC record is set
• DMARC blocks fake email

What we don't check

Scans run from outside your app. They don't test login flows, business logic or your source code, and they can't prove an app is secure.