LeakCheck
Free security scan for your vibe coded app
Built it with Lovable, Bolt, v0, Cursor or Replit? Paste your live app URL. LeakCheck checks it for exposed API keys, Supabase tables anyone can read, and leaked files like .env. The first preview needs no account: you get a score and every finding by title. Sign in free for more scans and the full top fixes.
Guides and checklists for Lovable, Bolt, v0, Cursor, Replit, Supabase, Firebase, and Next.js stay free to read. A newsletter every week, sponsors, and labeled affiliate links are how the site stays up.
LeakCheck
Find leaks in your app and code
LeakCheck is our scanner for AI-built apps. Check your live app by its URL, your public GitHub repo, or both. It reads only, and it never asks for your code or secrets.
- LeakCheck Free: one preview scan with no account (score and finding titles). Sign in free for more scans and the full top fixes.
- LeakCheck Pro, $15 USD a month (CA$20 in Canada): keeps watching up to 5 apps and emails you when something gets worse.
Questions
LeakCheck questions
Is there a free security scanner for vibe coded apps?
Yes. LeakCheck gives one preview scan of a live URL with no account: a score and every finding by title. Sign in free for more scans and the full top fixes. LeakCheck Pro (US$15 a month, CA$20 in Canada) keeps watching up to 5 apps and emails you when something gets worse.
Can I scan a Lovable or Bolt app?
Yes. LeakCheck scans any public URL, on a lovable.app address or your own domain, and recognizes Lovable, Bolt, v0, Supabase, Firebase and Next.js from the page. It reads what a stranger can see and never changes anything.
Does it check Supabase Row Level Security?
It uses your public anon key, read only, the way a stranger would, and names each table it can read when RLS is off or too broad. It never signs in or creates users, so it cannot see your policies or test what signed in users can reach. A service role or sb_secret_ key in the browser is always critical.
How do I check if an API key is exposed in my app?
Paste your live URL. LeakCheck reads your HTML and same-origin scripts for secret keys such as OpenAI, Anthropic, Stripe, AWS and Supabase service role, and checks for exposed .env, .git and source map files. Values are masked. Signed in, you can also check a public GitHub repo for leaked keys.
Is a clean scan proof that my app is safe?
No. It is an outside read of a public URL with capped scripts and probes. Auth logic, pages behind a login and private code stay out of view, so use the checklists too.
Checklists
Run these before launch
- 01ChecklistVibe coding security checklist: 10 checks before you shipA one page vibe coding security checklist for apps built with Lovable, Bolt, v0, Cursor or Replit: keys, database rules, auth, payments, files and rescans.
- 02ChecklistLovable and Bolt pre-launch security checklistA pre-launch security pass for Lovable, Bolt, v0, Cursor, and Replit apps: exposed keys, database rules, auth, storage, and payments before you share the URL.
- 03ChecklistFirebase security rules checklist for FirestoreReplace test mode, stop open Firebase security rules, and check ownership, queries, and custom claims before you ship Firestore.
- 04ChecklistSupabase RLS checklist: secure every table before launchSupabase RLS checklist for Lovable, Bolt, and Cursor apps: enable RLS, fix table grants, write one policy per operation, and test as anon before launch.
Guides
Read these when something looks off
On Supabase? Clear the Security Advisor warnings first, then make sure users cannot edit their own role, plan, or credits. Taking payments? Do not let the browser set the price or spend the same credits twice (Stripe price tampering and credit races). Have teams or invites? Make sure a removed team member loses access on the next request. AI feature that fetches links? Block SSRF in link previews and AI fetch tools. Issuing your own JWT? Store it in an HttpOnly cookie, not localStorage.
- 01GuideHow to check Supabase RLS on a Lovable appCheck RLS on a Lovable app step by step: find your backend, read the Policies view, run two read only SQL queries, test as a stranger, then scan for free.
- 02GuideFirebase Cloud Functions auth: onCall, onRequest and App Check, testedWhy request.auth is null, why onRequest functions are open to anyone with the URL, how to verify ID tokens, and what enforceAppCheck misses. Emulator tested.
- 03GuideMalicious Claude Code extension in Cursor (2.1.313): what to doA tampered Claude Code extension (2.1.312, 2.1.313) shipped via Cursor's marketplace on Oct 29, 2026. Check for the svc-telemetry key, clean up, rotate.
- 04GuideSupabase signOut scopes and session revocation, testedSupabase signOut() is global by default, and access tokens keep working after it. What local, others, password and email changes revoke, tested.
- 05GuideSupabase signup user enumeration, testedsupabase.auth.signUp returns a fake user for an existing email with Confirm email on and user_already_exists with it off. How apps leak it, and the fixes.
- 06Guidebleek alternative: free scan plus rescans after every deploybleek offers a free URL scan and a $19 one time Deep Scan. LeakCheck is free to scan, and Pro rescans your live app after every deploy for US$15 a month.
- 07GuideClerk route protection in Next.js: clerkMiddleware, testedclerkMiddleware() leaves every Next.js route public, and createRouteMatcher is now deprecated. What we saw in tests, and how to protect pages, APIs and actions.
- 08GuideFirebase custom claims for admin roles: 8 mistakes, testedHow to set a Firebase admin custom claim safely, why request.auth.token.admin stays stale for up to an hour, and how to remove admin for real. Emulator tested.
- 09GuideSupabase email change security: 8 gaps, testedSupabase updateUser({ email }) needs no password, reveals registered emails, and the last link signs in whoever opens it. What we tested, and the fixes.
- 10GuideSupabase password reset security: 7 gaps, testedSupabase resetPasswordForEmail can still reveal which emails exist, email scanners can burn the link, and old tokens outlive a reset. What we tested and fixed.
- 11GuideFree Supabase RLS checker: 3 ways to find open tablesCheck Supabase RLS for free three ways: the Security Advisor in Studio, one SQL query on pg_tables, and a read only LeakCheck scan of your live app.
- 12Guidepull_request_target and secret masking, testedHow GitHub Actions secrets leak: pull_request_target pwn requests, script injection and log masking gaps. We ran checkout v7, the runner masker and the fixes.
- 13GuideSupabase anonymous sign-ins: RLS and is_anonymous, testedAnonymous Supabase users get the authenticated role, so to authenticated policies let them in. We tested is_anonymous checks, conversion, limits and cleanup.
- 14GuideSupabase Auth redirect URLs: wildcards, testedSupabase Redirect URLs wildcards can send magic link tokens to any matching host. We tested Site URL, allow list patterns, Vercel previews and silent fallback.
- 15GuideLeast privilege API keys: Stripe, OpenAI, GitHub, GoogleScope every key your app uses: Stripe restricted keys, OpenAI project keys, GitHub fine-grained tokens, Supabase secret keys and minimal Google scopes.
- 16GuideSupabase error details that leak rows RLS hidesSupabase error.details can show another user's row, email and Stripe id included. What we saw leak, what Postgres already hides, and the fixes we tested.
- 17GuideSupabase ON DELETE CASCADE skips RLS: lock it downA cascade from one allowed DELETE wipes child rows that other users own, and RLS on the child table does not stop it. Tested fixes for Supabase.
- 18GuideSupabase signed upload URLs and list policies, testedWhat createSignedUploadUrl checks, what the token still allows after that, and how SELECT policies control list, download and signed URLs. Tested locally.
- 19GuideFirebase Storage rules: fix allow read, write: if trueWhat Firebase Storage test mode and open rules allow, how to find the rules your bucket really runs, and owner only upload rules with size and type limits.
- 20GuideSupabase rows deleted? Recover them and lock DELETE downSomeone wiped a Supabase table with your public key. What daily backups, PITR, and the Free plan can recover, and the grants and policies that block it.
- 21GuideSupabase Storage upload new row violates RLS policy fixSupabase Storage upload or upsert fails with new row violates row-level security policy? The storage.objects policies each case needs, tested.
- 22GuideSupabase upsert new row violates row-level security fixSupabase upsert needs INSERT, UPDATE and SELECT grants and policies. Each upsert RLS error, its tested fix, and the policies that stop overwrites.
- 23GuideAI coding tool breached? Rotate API keys and find every copyOpenCode Console and LiteLLM 1.107.0 exposed AI API keys in October 2026. See if you were hit, rotate OpenAI, Anthropic, Gemini and OpenRouter keys, cap spend.
- 24GuideCloudflare security audit skill and Strix on vibe-coded appsCloudflare's security-audit-skill and Strix let an AI agent audit your app. What each checks, what they miss in a vibe-coded app, and how to fill the gaps.
- 25GuideCloudflare Pages and Workers secrets without leaking .envWrangler vars vs secrets, why VITE_ and NEXT_PUBLIC_ values reach the browser even when encrypted, and how a .env ends up live on Cloudflare Pages.
- 26GuideRailway breach: what to rotate first (env vars, DB, keys)Railway says env vars may have been decrypted in the Oct 2026 breach. What to rotate first: database, Stripe, AI keys, OAuth, signing secrets, tokens.
- 27GuideSupabase 42501 permission denied after Oct 30: safe fixFrom Oct 30, 2026, new Supabase tables need explicit GRANTs or the API returns 42501. Grant only what each role needs, keep RLS on, and never grant all to anon.
- 28GuideExposed Supabase key? What to do now (anon vs service role)Found your Supabase key in public code or on GitHub? Check which key it is. An anon key is meant to be public; a leaked secret key needs rotating now.
- 29GuideIs my Lovable or Bolt app secure? How to checkIs your Lovable or Bolt app safe to share? Check for keys in the browser, open Supabase tables and exposed files, then run a free LeakCheck scan.
- 30GuidePrivate data in page source: __NEXT_DATA__ and RSC leaksFind user data your Next.js app ships in page source: __NEXT_DATA__, the RSC payload, Server Action returns, static pages and CDN caching, with tested fixes.
- 31GuideRemoved team member still has access in Supabase? Fix itCut off a removed teammate in Supabase for good. Fix stale JWT claims, old invite and share links, signed URLs, Realtime and sessions, then test each.
- 32GuideStop committing API keys with Gitleaks and push protectionBlock API keys before they reach GitHub: Gitleaks pre-commit and pre-push hooks, a CI scan, .gitignore for .env, push protection limits, and AI agent traps.
- 33GuideSupabase RLS on but using (true)? Find permissive policiesRLS is enabled and Security Advisor looks quiet, yet anyone can read the table. Find using (true), to public, and signed-in-only policies with one SQL query.
- 34GuideSupabase SECURITY DEFINER functions anyone can call via rpcAny function in your public schema is an API endpoint, and a SECURITY DEFINER one skips RLS. Find who can call it with the anon key, then lock it down and test.
- 35GuideVerify webhooks in Next.js: Clerk, Resend, GitHub, SupabaseVerify Clerk, Resend, GitHub, Paddle, Lemon Squeezy and Supabase webhooks in Next.js: raw body, signature, timestamp, constant-time compare, duplicates.
- 36GuideSSRF in Next.js: safe fetch for link previews and AI toolsStop SSRF in Next.js and Node fetch. Lock down link previews, AI URL tools, image imports and webhooks with a tested safe fetch helper you can copy.
- 37GuideStripe price tampering and credit race conditions, fixedStop users from changing Stripe Checkout prices and from spending the same credits twice with parallel requests. Tested Postgres and Supabase fixes.
- 38GuideSupabase column security: lock role, plan, and creditsAn owner-only RLS update policy still lets users set role, plan, or credits on their own row. Fix it with column grants, a trigger, or a separate table.
- 39GuideSupabase getSession insecure warning: getUser vs getClaimsWhy Supabase warns that getSession() could be insecure on the server, when to use getClaims() or getUser(), and the Next.js fix for proxy, pages, and actions.
- 40GuideJWT in localStorage or httpOnly cookie? Where to store itlocalStorage or httpOnly cookie for your JWT? What XSS and CSRF can do with each, what Supabase, Clerk, Auth.js and Firebase do, and a tested Next.js fix.
- 41GuideClient-side auth is not security: protect your admin pageA JS role check, localStorage flag, or email gate only hides your admin page. Enforce roles on the server with Supabase RLS, Next.js, Firebase, or Clerk.
- 42GuideHow to hide API keys in an Expo or React Native appEXPO_PUBLIC_ and .env values ship inside your app. Which keys are safe in a mobile bundle, and how to move OpenAI and secret keys to a server proxy.
- 43GuideStop brute force and credential stuffing on your loginRate limits, CAPTCHA, lockout, and MFA for Supabase, Clerk, Firebase, and Auth.js logins, plus generic errors and a safe way to test your own app.
- 44GuideMCP server security: what to check before you install oneBefore you add an MCP server to Cursor, Claude Code, or VS Code: tool poisoning, prompt injection, rug pulls, leaked tokens, and settings that limit damage.
- 45GuideFix Supabase 'infinite recursion detected in policy'Why Supabase RLS throws 42P17 infinite recursion, the safe private security definer fix, and the AI quick fixes that quietly open your data.
- 46GuideFix Supabase Security Advisor warnings: SQL for each lintFix every Supabase Security Advisor warning: RLS disabled in public, mutable search_path, security definer views. What each means and the exact SQL.
- 47GuideFirestore allow read, write: if true makes your data publicWhat Firebase test mode and if true rules really allow, how to check whether your Firestore or Storage is open to the public, and the rules to deploy instead.
- 48GuideSQL injection in Prisma, Drizzle, and SupabaseFix SQL injection in Prisma, Drizzle, and Supabase: tagged templates, never sql.raw with user input, and parameterize Postgres functions called via rpc.
- 49GuideSupabase Edge Function auth: verify JWT and callersSecure Supabase Edge Functions: what verify_jwt does not prove, getClaims vs getUser, secret key safety, signed webhooks, CORS, and rate limits.
- 50GuideSupabase Realtime authorization: private channels and RLSSecure Supabase Realtime: private channels, RLS on realtime.messages for Broadcast and Presence, postgres_changes, and vibe-coded mistakes.
- 51GuideSupabase Realtime: broadcast from the databaseHarden Supabase Realtime broadcast from Postgres: realtime.send, broadcast_changes, private channels, payload leakage, and vibe-coded trigger mistakes.
- 52GuideSupabase views and functions that bypass RLSFix Supabase views and SECURITY DEFINER functions that skip RLS: set security_invoker, pin search_path, revoke EXECUTE, and test as anon.
- 53GuideHow to test Supabase RLS policies in CI with pgTAPTest Supabase RLS with pgTAP and supabase test db: block anon and cross-tenant access, fail CI on tables without RLS, and run it all in GitHub Actions.
- 54GuideAI hallucinated packages and slopsquattingAI coding tools sometimes suggest npm or PyPI packages that do not exist, and attackers register the names. How it works, and a quick check before you install.
- 55GuideAUTH_SECRET and NEXTAUTH_SECRET: set and rotateAuth.js needs AUTH_SECRET (NEXTAUTH_SECRET in older NextAuth) on the server only. What it encrypts, how to generate a strong value, and how to rotate it safely.
- 56GuideCORS misconfiguration in vibe-coded appsAI tools often 'fix' CORS errors by allowing every origin or turning on credentials. What is dangerous in Next.js, Express, and Supabase, plus safe configs.
- 57GuideContent-Security-Policy for vibe-coded appsWhere to set a CSP header on Next.js, Vercel, and static hosts, a starter policy, what breaks with Stripe, Clerk, and Supabase, and a safe Report-Only rollout.
- 58GuideIs your .env, .git, or source code public?How vibe-coded apps end up serving .env files, .git folders, and source maps, a five-minute check for your site, and fixes for Vercel, Netlify, and Cloudflare.
- 59GuideFix IDOR (BOLA) in Next.js and SupabaseFix IDOR in Next.js Route Handlers and Supabase: get the user from a verified session, scope every query by owner, add RLS, and test with a second account.
- 60GuideFix open redirects in Auth.js, Supabase, and ClerkAI-built login flows often redirect to any callbackUrl, redirectTo, or next value in the URL, sending users to phishing sites. How to allow-list redirects.
- 61GuidePrompt injection defense for vibe-coded AI appsIf your app sends user text, files, or web pages to an LLM, someone can hijack it. How prompt injection hits chatbots, RAG, and agents, and how to limit it.
- 62GuideRate limit OpenAI API routes in Next.js and SupabaseRate limit OpenAI and other LLM API routes in Next.js and Supabase: per-user and per-IP limits with Upstash, daily token budgets, and provider spend caps.
- 63GuideSecure file uploads in Next.js and SupabaseStop uploads that trust file.type, skip auth, or land in public/. Use direct-to-storage uploads, MIME allow-lists, safe filenames, and private storage buckets.
- 64GuideSecure Vercel Cron jobs with CRON_SECRETAI-generated apps often leave /api/cron routes open. How Vercel sends CRON_SECRET as a Bearer token, how to return 401 to other callers, and fail-open bugs.
- 65GuideFix XSS in React and Next.js: dangerouslySetInnerHTMLReact escapes JSX text, but dangerouslySetInnerHTML, rehype-raw, and AI chat output can still run attacker scripts. Sanitize with DOMPurify and allow-list URLs.
- 66GuideClerk publishable key vs secret key explainedYour Clerk pk_ key is fine in frontend code; your sk_ key and whsec_ secret are not. The right env var names for Next.js and Vite, and how to rotate a leak.
- 67GuideIs it safe to expose your Firebase API key?Why the Firebase web API key is public by design, the one restriction that makes it dangerous, and how Security Rules and App Check actually protect your data.
- 68GuideCVE-2025-29927: Next.js middleware auth bypass fixCVE-2025-29927 let one x-middleware-subrequest header skip Next.js middleware auth. Affected versions, patched releases, who is safe, and how to fix it.
- 69GuideRemove a leaked API key from GitHub historyRotate the key first, then purge it from every commit with git filter-repo or BFG, force-push carefully, and clean up clones, forks, and GitHub's cached views.
- 70GuideStripe paywall bypass on the success pageIf your app grants paid access when someone lands on ?success=true, anyone can type that URL. Unlock features only from verified Stripe data, using webhooks.
- 71GuideSupabase Auth security settings before launchSupabase Auth settings AI-built apps leave on defaults: Site URL, redirects, email confirmation, password rules, leaked password checks, and reauthentication.
- 72GuideSecure Vercel preview deployments and env varsPreview URLs can expose unfinished features and production data. Set Deployment Protection, split Preview and Production env vars, use Secret variables.
- 73GuideHow to check if your API key leaked on GitHubSearch your repo, your git history, and GitHub's own alerts for exposed API keys, then know what to do when you find one, starting with rotation.
- 74GuideEnv variables in Cursor, Bolt.new, and LovableWhich env vars end up in the browser, how to keep .env files away from AI agents and git, and where server secrets belong in Cursor, Bolt.new, and Lovable.
- 75GuideNext.js Server Actions security: auth and validationServer Actions are public HTTP endpoints. How to add authentication, authorization, and input validation so AI generated actions are safe to ship.
- 76GuideStop strangers from running up your OpenAI billYour AI API route is a free proxy to your OpenAI or Anthropic account until you lock it down. Auth, rate limits, input caps, and spend limits.
- 77GuideReplit Secrets: how to store API keys safelyStore API keys in Replit Secrets, read them safely in Python or Node, and stop them leaking through public Repls, frontend code, git history and logs.
- 78GuideA security review prompt for AI coding toolsA copy-paste prompt that asks an AI coding tool for a security review, plus how to read the answer without trusting it blindly.
- 79GuideSupabase anon key vs service role keyWhich Supabase key is safe in the browser, which one bypasses Row Level Security, and where each belongs in a Lovable, Bolt, or Next.js app.
- 80GuideSupabase Storage security: buckets and RLSStop strangers from listing, downloading or overwriting files in Supabase Storage: public vs private buckets, per-user folder RLS policies and signed URLs.
- 81GuideCommon vulnerabilities in vibe-coded appsHow IDOR, exposed service role keys, and missing auth on API routes show up in apps built with AI coding tools, and how to fix each one.
- 82GuideVerify Stripe webhook signatures in Next.js and SupabaseCheck the Stripe-Signature header on the raw body, keep the webhook secret on the server, and ignore duplicate events before you grant access.
- 83GuideKeep secret API keys out of frontend codeWhat Next.js and Vite put in the browser bundle, which keys are safe there, and where Supabase, Firebase, and Stripe secret keys actually belong.
- 84GuideLeaked API key? What to do in the first hourLeaked an API key? Revoke it first, check logs for use, swap in a key with less access, and clean git history only after the old key is dead.
Newsletter
One useful security note every week
Leaks, rules, and launch checks. No invented incident counts. Read Edition 1.