bleek alternative: free scan plus rescans after every deploy

bleek and LeakCheck both scan a live vibe coded app from the outside. Both say they are read only. Both have a free scan. The difference is how you pay. bleek sells a one time $19 Deep Scan and a human audit. LeakCheck Pro keeps watching up to 5 apps and rescans seconds after every deploy for US$15 a month. Want one deep pass? bleek fits. Ship often? LeakCheck fits.

bleek vs LeakCheck

	bleek	LeakCheck
How it checks	Paste a live URL. Read only.	Live app by URL, a public GitHub repo, or both. Read only: GET, HEAD and OPTIONS requests plus read only Supabase or Firebase probes.
Free	Free Scan, no signup. Its pricing page lists exposed keys, public database tables, headers, HTTPS, cookies and email spoofing, plus more checks.	One preview scan a day with no account. Sign in free for up to 5 scans every 10 minutes, the public GitHub repo check, and full details plus a fix prompt for the top 2 findings.
Paid	Deep Scan, $19 one time: 5 safe attack probes, a dependency check, a shareable PDF report and free re-scans for 30 days. Human Audit from $300, fixed scope.	Pro: US$15 a month or US$144 a year (CA$20 a month or CA$192 a year in Canada). Every finding in full, up to 5 apps, a rescan after every deploy (up to 30 a day), scheduled rescans, alerts by email, Slack or Discord.
Supabase	Flags service_role keys in JS bundles. Lists Supabase RLS probing in the Deep Scan.	Finds service role and sb_secret_ keys. Notes the public anon or publishable key as expected, with no grade penalty, then names each table that key can read. Read only Supabase probes.
Human review	Yes, the Human Audit tier	No

bleek facts come from bleek.dev, its pricing page and its llms.txt. LeakCheck facts come from LeakCheck pricing and LeakCheck. Checked October 29, 2026. Something out of date? Tell us at hello@vibelocked.com.

Where bleek is the better choice

• You want to pay once instead of a subscription.
• You want a shareable PDF report for your team or investors.
• You want a person to test business logic and access between users. bleek says a URL scanner cannot confirm those. It offers a human audit for them.

Where LeakCheck fits

• You ship AI written changes often. You want a rescan right after each deploy.
• You want alerts when a key or open table comes back.
• You want to check a public GitHub repo for leaked keys too.

Either way, test access between users

No URL scan proves that User A cannot read User B's rows. Test your policies directly. See test Supabase RLS in CI and the Supabase RLS checklist.

See what your app exposes right now. Run a free LeakCheck scan. Then let LeakCheck Pro recheck after every deploy.