Check your live app by its URL, your code in a public GitHub repo, or both. Read only. We never ask for your code or secrets.
Try one free scan now, no account needed. Have an account?
Welcome back, .
Your watched apps (0 of 3)
No apps yet. Add your first app and LeakCheck checks it for you on a schedule (weekly by default, or daily or monthly), keeps a full report, and emails you if something gets worse.
Pro covers up to 5 apps and you are watching 5. To watch a different app, open one of the reports above and choose Remove app. Its slot frees up right away.
1. Your app
2. Prove you own it
3. Watched
Show us you control , so only you can watch it. Pick one way:
Option A: add a small file (easiest)
Create a file at this path in your app's public folder:
/.well-known/vibelocked-verify.txt
Put only this code inside it, then deploy:
In Lovable, Bolt, or v0, ask: "Add a public file at /.well-known/vibelocked-verify.txt containing exactly this text: ".
Option B: add a DNS record
Add a TXT record with this name:
and this value:
The code works for 24 hours. We only read that one file or record.
This usually takes 10 to 30 seconds. Keep this page open.
My apps
Watching apps comes with LeakCheck Pro. Add up to 5 apps and LeakCheck checks them on a schedule, keeps a full report, and emails you if something gets worse. On Free you can still scan any app below.
Sign in free to scan again now and see the top 2 fixes in full. This preview is the score and every finding by title. Another preview opens 24 hours after the last one. You come straight back here with your URL filled in, and the scan starts on its own.
Free stays free. We keep your email and name so you can use LeakCheck. See the privacy policy.
Read only. We look at your app the way a stranger would and never change anything. Up to 5 scans every 10 minutes.
Technical notes
Scans run on a Cloudflare Worker using GET, HEAD, and OPTIONS requests only, plus read-only Supabase or Firebase probes. Pro apps you have verified get deeper read-only checks. We never create users or write data.
Check my code
Public GitHub repos only. Nothing private needed: your browser reads the repo and checks up to 150 files.
Technical notes
Files are read from GitHub's public API and raw.githubusercontent.com and checked in your browser. We skip node_modules, lockfiles, binaries, and files over 200 KB. GitHub allows about 60 API calls per hour per network without login, and a scan uses three. For a private repo, run Gitleaks or TruffleHog on your own machine or in CI.
Live app results
Code results
Create your LeakCheck account
Your first live scan works without an account. Sign in free with Google or email to keep scanning and see the top 2 fixes in full, or upgrade to Pro any time.
Current plan
LeakCheck Free
US$0free account
Check one app or repo, right now.
Live app check and code check
Score, grade, and every finding by title
Full details and fix prompt for the top 2
Markdown report and README badge
Up to 5 scans every 10 minutes
Current planCurrent plan, cancelled
LeakCheck Pro For apps you ship
$15USD a month, cancel any time
$12USD a month, billed $144 yearly
Everything in Free, plus LeakCheck keeps checking your app after you ship and tells you when something new is exposed.
Full details and a fix prompt for every finding
Watch up to 5 apps
Rescan seconds after every deploy. Each AI-written change can bring back an exposed key or an open database table. LeakCheck checks the live app right after you ship.
Daily, weekly, or monthly rescans, even when you change nothing. New CVEs come out for libraries you use, a TLS certificate gets close to expiring, a setting drifts. LeakCheck checks again for you, so you don't have to remember to.
Alerts by email, Slack, or Discord when a new high or critical finding shows up or your score drops, so you can fix it before a user or attacker finds it.
Coming soon: GitHub deploy check that can fail the build on a bad score
Live Verified badge and scan history for each app
Sign in first, then secure Stripe checkout opens for $15 a month or $144 a year.
Already have an account? . We keep your email and name so you can use LeakCheck. See the privacy policy and terms.
Everything in Free, plus LeakCheck keeps checking your app after you ship and tells you when something new is exposed.
Full details and a fix prompt for every finding
Watch up to 5 apps
Rescan seconds after every deploy. Each AI-written change can bring back an exposed key or an open database table. LeakCheck checks the live app right after you ship.
Daily, weekly, or monthly rescans, even when you change nothing. New CVEs come out for libraries you use, a TLS certificate gets close to expiring, a setting drifts. LeakCheck checks again for you, so you don't have to remember to.
Alerts by email, Slack, or Discord when a new high or critical finding shows up or your score drops, so you can fix it before a user or attacker finds it.
Coming soon: GitHub deploy check that can fail the build on a bad score
Pro is $15 a month, or $144 a year, plus any tax, until you cancel. Checkout is hosted by Stripe. Plan details and refunds
What the live app check looks for
Stack and client library fingerprint with a curated free CVE pack (including CVE-2025-29927), Firebase path probes, OpenAPI GET expansion, Appwrite/PocketBase/Hasura/Convex, Fix now playbooks, Serious vs Hardening tips, and a README score badge
Risk score 0-100, peer comparison by stack (anonymous buckets only), TLS expiry and HTTPS redirect notes
Email spoofing protection for your own domain: SPF and DMARC records, mail provider, and DKIM for Resend, Google Workspace or Microsoft 365, with the exact DNS records to add (read-only DNS lookups, no email sent)
Export Markdown report, copy a shareable summary, and one-click copy a README badge snippet; scan again anytime to see what improved
What the code check looks for
OpenAI, Anthropic, Google (Gemini, Maps), Groq, xAI, Replicate, Hugging Face tokens
Stripe or Clerk secret and publishable keys, Stripe restricted keys, and Stripe or Clerk webhook signing secrets
Supabase service role keys (legacy JWT with role service_role) and new sb_secret_ keys
AWS access key IDs and secret keys, GitHub and GitLab tokens, Slack tokens and webhooks
Twilio, SendGrid, Resend, Discord webhooks, private key blocks, and database URLs with a password
Generic secret assignments, such as SECRET=, TOKEN=, or PASSWORD= with a long value
Publishable values like a Stripe pk_ key, a Supabase anon key, or a Firebase web config are reported as safe to ship, so you can tell them apart from real secrets. See anon key vs service role key.
A token in a committed .cursor/mcp.json or .mcp.json counts too. The MCP server security guide shows how to reference environment variables instead, and how to scope those tokens.
Code check limits
The repo scan reads the current branch only, not old commits, and stops at 150 files. Pattern matching misses keys with no fixed format and can flag test values. A clean result is not proof that a project is safe: a missing auth check, like an admin page guarded only in the browser, never shows up in a key scan (client-side auth is not security). For private repos and full history, run Gitleaks or TruffleHog on your own machine or in CI.
Ownership
When you add an app to Pro, you prove you control it with a small file at /.well-known/vibelocked-verify.txt or a DNS TXT record on _vibelocked-verify. Verified apps get deeper read-only checks. We still never write data or create users.
The data behind it
We ran these same read-only checks against 2,511 live vibe-coded apps on nine platforms. About one in five Supabase apps left a database table open to anyone. Read the study. If your Supabase dashboard already shows "RLS Disabled in Public" or similar warnings, Supabase Security Advisor warnings explained has the SQL fix for each one.
Live app check limits
This is an outside read of a public URL. A clean result is not a guarantee. Cap: about 20 same-origin scripts, about 1.5 MB each, short timeouts, capped probe counts.