For apps built with Lovable, Bolt, Cursor, Replit & v0
Is your AI-built app leaking secrets?
Find out in 20 seconds, free.
Paste your live URL. We check what every visitor's browser downloads — your HTML and every JavaScript file — for leaked API keys, exposed .env/.git files and missing security headers. Free score out of 100. Copy-paste fixes for $9, one-time.
Free · No signup to scan · Passive and read-only · Automated check, not a security audit
1critical
1high
1medium
3low
- CRITICALSupabase service_role key in your JavaScript
eyJhbG**** - HIGHPublic .env file is downloadable
STRIPE_SECRET_KEY=**** - MEDIUMNo Content-Security-Policy header
Fix prompt · paste into Lovable
Move all Supabase calls that use the service_role key into an Edge Function, rotate the key, and…Illustration of a report. Your results depend on your app.
How it works
Score first. Pay only if you want the fixes.
Paste your live URL
We load your app the way any visitor's browser does and read the HTML plus every JavaScript file it ships. Takes about 20 seconds. No signup.
Get your score — free
You see your score out of 100 and how many critical, high, medium and low problems we found. Add your email (still free) to see every problem, where it is, and masked evidence.
Fix it — $9 or DIY
Want it done fast? $9 one-time gets a copy-paste fix prompt per issue for Lovable, Bolt or Cursor. Prefer to do it yourself? Our free guides walk you through it.
Your bundle is public
Every key the AI pasted into frontend code ships to every visitor — and automated bots constantly crawl public sites looking for exactly that.
One prompt can undo it
Ask your AI builder for a new feature and it may quietly re-add a key or drop a header. That's why it's worth re-scanning after every deploy. Automatic monitoring is coming soon.
Fixes you can paste
No jargon homework: every finding comes with a prompt your AI builder understands, written for Lovable, Bolt and Cursor.
What the free scan checks
The mistakes that actually get AI-built apps drained.
Supabase service_role key
We decode every Supabase JWT in your bundles. A service_role key in the browser = anyone can read and delete your whole database.
Live Stripe, OpenAI, Anthropic & AWS keys
sk_live_, rk_live_, sk-, sk-ant-, AKIA… and private keys hiding in your JavaScript — including lazy-loaded chunks most scanners skip.
Public .env and .git
One request each to /.env and /.git/config. We only flag real-looking content, and we never show the values.
Supabase anon key + RLS reminder
Your anon key is meant to be public — but only safe if Row Level Security is on for every table. We tell you exactly what to verify.
Security headers
CSP, HSTS, clickjacking protection, nosniff, Referrer-Policy, Permissions-Policy — the settings AI builders forget.
HTTPS & SSL expiry
Is HTTP redirected? Is your certificate trusted, and how many days until it expires?
Three ways to find out if you're leaking
Hire a security consultant
$$$ · days to weeks
- ✓ Deep, human review
- ✗ Overkill before you have users
- ✗ Stale after your next prompt
Ask your AI to audit itself
Free · hours of back-and-forth
- ✓ Knows your code
- ✗ Doesn't see what's actually deployed
- ✗ Same model that wrote the bug
Outside-in scan of your live app
$0 scan · ~20 seconds
- ✓ Sees exactly what attackers see
- ✓ Crawls lazy-loaded JS chunks
- ✓ $9 one-time for paste-ready fixes
Built to be safe to run on production.
No testimonials here yet — we just launched. Instead, here's exactly what the scanner does and doesn't do.
What a passive scan can't see
- Your server code, private API routes and environment variables that never reach the browser.
- Whether your Supabase RLS policies actually block strangers — we remind you to check, we don't query your data.
- Logic bugs, weak auth flows or anything behind a login.
A clean score means none of the common public leaks we look for — not that your app is secure.
Questions? plugleak@mail.grokbot.com
✓ Passive only
GET requests a normal browser makes. No logins, no forms, no exploits.
✓ Secrets masked
First 6 characters + ****. Full keys are never stored or shown.
✓ No database queries
We never touch your Supabase tables in the free scan.
✓ Identifiable
Our requests say PlugLeakScanner in the User-Agent, so you can see us in your logs.
✓ Private IPs blocked
Internal networks are off-limits; requests time out and are size-capped.
✓ Honest scope
Automated check, not a security audit. We tell you what we can't see.
Free to scan. Pay once to fix.
No subscription. Your score is always free.
Fix report
$9 one-time
- ✓ Copy-paste fix prompt per issue
- ✓ For Lovable, Bolt & Cursor
- ✓ What to rotate + how to verify
Bought from your report page, after the free scan.
10 fix reports
$29 one-time
- ✓ 10 fix reports (credits)
- ✓ Re-scan yourself after each deploy
- ✓ Use on any of your apps
Monitoring SOON
Weekly + after-deploy re-scans with email alerts.
Free guides
Fix it yourself, step by step
Supabase RLS checklist for Lovable, Bolt, and Cursor apps
A practical Row Level Security checklist for Supabase apps built with Lovable, Bolt, or Cursor: grants, real policy SQL, how to test as a stranger, and what a passive scan cannot see.
Bolt shows your Supabase URL and API key. Is that a leak?
Seeing a Supabase URL and API key in a Bolt app's network tab is often normal. Here is how to tell a publishable anon key from a service_role secret, and what to do in each case.
Supabase service_role key exposed? What it means and how to fix it (fast)
Found your Supabase service_role key in your frontend? Here's why it's critical, how to check, and the exact steps to rotate it and move it server-side.
Lovable app security check: the 7 things to verify before launch
A practical security checklist for apps built with Lovable (and Bolt or v0): leaked keys, Supabase RLS, .env exposure, headers and SSL — plus a free automated check.
Is my vibe-coded app secure? A 10-minute self-check
Built your app with AI? Here's how to tell if it's secure: what attackers look at first, how to check it yourself in 10 minutes, and what an automated scan can and can't tell you.
FAQ
Is it safe to scan my live app?+
Yes. The free scan only makes the same GET requests any visitor's browser makes, plus one request each to /.env and /.git/config. It never logs in, submits forms, queries your database or tries to exploit anything.
Do you store my secrets?+
No. Any key we find is masked on the spot (first 6 characters + ****) before the report is saved. We never store a full secret.
What does the $9 Fix report include?+
Every finding comes with a copy-paste prompt written for Lovable, Bolt or Cursor, so your AI builder can fix it for you — plus what to rotate and how to verify the fix.
Why does it ask for my email?+
The score is free and instant. To see the full list of problems we ask for an email so we can send you the report link and tell you when weekly monitoring launches. No spam; unsubscribe any time.
Can it check my Supabase RLS policies?+
Not in the free scan — that would mean querying your database, which we only want to do for verified owners. A deep RLS check for verified owners is coming soon.
Is this a security audit?+
No. It's an automated check of what your app exposes publicly. It catches common, costly mistakes fast, but it can't prove your app is secure.