Shipped it with Lovable, Bolt or Cursor? Check it for leaked keys and open Supabase tables before someone else does.
LeakLint runs a read-only, outside-in check of your live app and tells you in plain English what to fix, with copy-paste prompts for your AI builder.
Free scan
Only scan apps you own. We verify ownership before any scan runs.
Step 2: prove you own it
Add one of these to your live app, redeploy, then click Verify and scan.
Option A: a file at /.well-known/leaklint.txt containing:
Option B: in your homepage <head> (in Lovable, ask: "add this meta tag to index.html"):
Pricing
Every finding with copy-paste fix prompts for Lovable or Cursor.
Buy reportWe fix it with you (RLS policies, moving keys server-side), then rescan.
Book a fixMonthly rescan and an alert if something new leaks.
SubscribeFAQ
No. Only scan apps you own or have written permission to test. LeakLint will not scan a site until its owner publishes a verification token.
Will the scan change my data?No. Checks are read-only: we fetch your public pages and JavaScript, and test whether a table is readable using your public anon key with a one-row read. We never record row contents or write anything.
What do you check?Leaked secret keys (OpenAI, Anthropic, Stripe, AWS, Supabase service_role and more), Supabase tables readable without login, exposed .env and .git files, HTTPS and security headers.
Does a clean result mean I'm secure?No. It means these outside-in checks found nothing. It is not a full audit.