Cybersecurity
LeakWatch
Security scanner that shows what strangers can read from your deployed app
A read-only security scanner that detects exposed secrets, misconfigured databases, and other vulnerabilities in deployed web applications built with Lovable
Overview
The LeakWatch homepage
LeakWatch is a security scanner that performs read-only GET requests on deployed websites to identify what publicly accessible information a stranger could read. It detects exposed API keys, secrets, misconfigured databases with row-level security disabled, open Firebase rules, exposed environment files, certificate issues, and CORS misconfigurations. The scan sends the same kind of request a stranger already can send, then documents what came back.
The free scan names every finding with its severity. A paid Proof Report for $19 unlocks the location, evidence, and fix prompt for all findings. The tool is designed for applications built with Lovable, Bolt, Cursor, Replit, Supabase, and v0. Monitoring at $9/month provides weekly rescans of one app you own. Pro at $29/month covers up to 10 apps and includes GitHub repository scanning for known vulnerabilities and secrets in commit history.
Capabilities
- Detects exposed API keys and secrets from OpenAI, Anthropic, Stripe, AWS, Google, GitHub, SendGrid, Resend, Slack, Twilio, Firebase, and private keys
- Checks Supabase with RLS disabled to detect readable tables
- Scans for exposed environment files (.env, .env.local, .git/config, source maps)
- Tests Firebase Realtime Database and Firestore rules for open access
- Audits security headers and CORS configuration
- Monitors certificate expiry status on HTTPS sites
- GitHub repository scanning for Pro users to detect secrets in commit history
- Weekly rescans and instant alerts when new vulnerabilities appear
- Fix prompts compatible with Lovable, Bolt, Cursor, Claude Code, v0, and Replit
- Masked secrets in reports showing only first and last four characters
Pricing
Pricing model: Freemium
Free scan available once per network every 30 days. Proof Report: $19 once per scan. Monitoring: $9/month for weekly rescans of one app. Pro: $29/month for up to 10 apps with reports unlocked and GitHub code scanning.
Follow LeakWatch to get an email when they post a milestone, ship a new product or add a demo video.
LeakWatch fact sheet
| Community votes | 0 |
|---|---|
| Based in | Canada |
| Website | getleakwatch.online |
LeakWatch metrics
Vendor metrics for getleakwatch.online: Ahrefs Domain Rating and Majestic link data, with the delta since the last review.
- Domain Rating
- 0
- no change since last check
- Trust Flow
- 0
- no change since last check
- Citation Flow
- 0
- no change since last check
- Referring domains
- 0
- no change since last check
- External backlinks
- 0
- no change since last check
Vendor Domain Rating (Ahrefs) checked 5 Nov 2026, spec changed 27 Oct 2026. Vendor Majestic data checked 27 Oct 2026, spec changed 27 Oct 2026. Link metrics supplied by Majestic. Trust Flow, Citation Flow and Topical Trust Flow are trademarks of Majestic-12 Ltd.
LeakWatch vendor domain
Open the vendor record
We read this from the registry's RDAP record on 2 Nov 2026, 08:28 UTC.
- Domain age
- 20 days
- Registered
- Expires
- Registrar
- HOSTINGER operations, UAB
- DNSSEC
- Not signed
LeakWatch post-launch report
| Measure | At launch, then latest |
|---|---|
| Domain Rating (Ahrefs) | 0 to 0 no change since launch 27 Oct 2026, then 5 Nov 2026 |
| Trust Flow (Majestic) | 0 first measured 27 Oct 2026 |
| Referring domains (Majestic) | 0 first measured 27 Oct 2026 |
Day 9 since launch. Next receipt: day 30, 26 Nov 2026. Many things move these figures, so a change is not proof of cause. Only stored readings are shown.
About to launch?
Plan your launch with our free playbook, from preparing your listing to choosing more launch directories.
- The week before
- On the day
- Week one
- Beyond launch
Buyer questions
Do you attack the site?
No. The scan sends only read-only GET requests to fetch the public HTML, scripts, and well-known paths. On HTTPS sites, a TLS connection is opened to read the certificate date. No logins, form submissions, database writes, or exploit payloads are sent.
Do you store the secrets?
No. Paid reports show only the first four and last four characters of secrets. The middle is discarded. Source maps, environment files, and database rows are not saved.
What does the $19 Proof Report include?
The location, evidence, request, and fix prompt for every finding on that one scan, plus one re-scan within 14 days. If any finding marked serious turns out not to be real, you get a full refund within 14 days.
Will LeakWatch see a Lovable or Bolt app?
Yes. Those apps are ordinary websites once deployed. The fix prompts are written so you can paste them back into Lovable, Bolt, Cursor, Replit, Claude Code, or v0.
Why the email?
We send the scan summary there. The $19 Proof Report is bought for that scan. One free scan per network every 30 days.
Leave a review for LeakWatch
No customer reviews of LeakWatch yet. Write the first. Customer reviews are free and nobody can buy them.
LeakWatch has a free listing. The owner can unlock the full profile with a paid launch for $5:
- Founder story (locked)
- Milestones (locked)
- Demo video (locked)
- Dofollow website link (locked)
Compare with
| # | Product | DR | Votes |
|---|---|---|---|
| 1 |  Dep |
0 no change since last check | 0 votes. Log in to vote for DepRadar as a buyer |
| 2 |  tokenizenWe find the leaks. We publish the numbers. |
0 no change since last check | 0 votes. Log in to vote for tokenizen as a buyer |
| 3 |  Fraud |
0 no change since last check | 0 votes. Log in to vote for FraudNova as a buyer |
| 4 |  Korzen Bot ProtectionCustomers in, bots out |
0 no change since last check | 0 votes. Log in to vote for Korzen Bot Protection as a buyer |