AppLeakWatch
Security scanner for apps built with Windsurf
Whichever AI editor wrote your code, the risks show up in the deployed app. AppLeakWatch checks that live app from the outside.
What usually goes wrong
Keys in generated code
A key pasted during a coding session can end up in code that ships to browsers.
Missing access rules
Generated code often covers the working path, not the question of who should be allowed.
Leftover files
Environment files and backups can get deployed by accident.
What else we check
- API keys for Stripe, OpenAI, Anthropic, AWS and others in your public code
- Downloadable .env, .git and database backup files
- API addresses that return data without a login
- SPF and DMARC records that stop people faking your email
- HTTPS redirects, certificates and browser security headers
How it works
Add your domain, prove you own it with one small change, and get a report with a letter grade and every check we ran. Scans only read public addresses and never change anything. No scan can prove an app is secure, but it can find the mistakes strangers look for first.