For apps made with Lovable, Bolt, Cursor or Supabase

Is your app leaking secrets?

Find out in about a minute. We check your live app for keys, open tables and files that should not be public. Then we give you fix steps to paste into your AI tool.

Scan my app free
Only sites you ownWe only read, never changeWe hide keys and never keep them
leakowl.com/s/example
Example only, not a real scan

Your free summary

The counts are free. You pay to see the details and fix steps.

2Critical
1High
3Medium
1Low
CriticalSecret key in your code
CriticalTable anyone can read
HighSource code is public
Start here

Scan your app for free

Next, you show you own the app by adding one small file. We never scan a site before that. The scan is free.

How it works

Three steps. The first two are free.

1

Show it is your app

Add one small file to your site. We give you a prompt, so your AI tool can do it for you. We never scan a site you do not own.

2

Get your free summary

We make about 30 safe, read-only checks. Then you see how many issues we found, by how bad they are.

3

Pay, then see the fixes

You pay first. Then you see each issue, where it is, why it matters, and a fix step to paste.

What we check

The leaks AI tools leave behind

Leaked keys

Keys for Stripe, OpenAI, AWS or GitHub that sit in your public code. We also look for the Supabase service_role key.

Open tables

Supabase tables that anyone can read. This happens when the row rules are off or too loose.

Open files

Files like .env or .git that should not be public. Also maps that show your source code.

Open pages

Admin and debug pages that work with no login. We also check if your site lets any other site read its data.

Headers and cookies

Safety headers your site should send. Login cookies that are missing their safe settings.

Weekly checks

On a plan, we check again each week. We email you when we find something new, or when a fix works.

Pricing

The summary is always free

You only pay to see the details. You always pay first, and we never charge you later by surprise.

One report

$10 one time
  • The full report for one scan
  • Where each issue is, with proof
  • Why it matters, in plain words
  • A fix step for each issue
  • Print it or save it as a PDF
  • Weekly checks
  • Email alerts
Start with a free scan
Keep watch

Watch my apps

Weekly checks and alerts

Solo · 1 app$19/mo
Studio · 3 apps$39/mo
Agency · 10 apps$79/mo
  • Your first full report is included
  • We check again each week
  • Emails when we find new issues
  • Emails when a fix works
  • Stop any time
Scan my app free

How you pay

  • The scan and summary are free. No card needed.
  • To see the details, you pay first. We show you what the scan already found.
  • A plan is paid at the start of each month. That covers all the weekly checks that month.
  • We only charge you when you start a checkout or when your plan renews. You can stop it any time.

Prices in US dollars. Stripe handles the payment. We never see your card.

Questions

Plain answers

Why must I show I own the app?

So no one can scan an app that is not theirs. We check your proof again at each scan. We log who did it and when.

Will the scan break my app?

No. We only read pages, about 30 of them. We never log in, send attacks or change data.

Do you keep my keys or data?

No. We hide keys in the report. We never keep rows from your tables, only column names and counts.

Is this a full security test?

No. It is a quick check of what anyone can see from outside. A clean result does not mean your app is fully safe.

Let the owl keep watch

Your first scan takes about a minute. On a plan, we check again each week. A new leak will not stay public for long.

Scan my app free