About

About LeakOwl

What we check, how ownership proof works, and how you pay.

LeakOwl is a security watch for vibe-coded apps — apps built with tools like Lovable, Bolt, Cursor, Replit, v0, and similar builders that ship a live web app with a Supabase or other backend behind them.

It answers one question: what can anyone see from the outside?

What LeakOwl checks

From the live site, LeakOwl's outside-in checks cover:

• Leaked keys — keys for Stripe, OpenAI, AWS, or GitHub in public code, including the Supabase service_role key
• Open tables — Supabase tables anyone can read when row rules (RLS) are off or too loose
• Open files — files like .env or .git that should not be public, and source maps that expose source code
• Open pages — admin and debug pages that work with no login, plus sites that let any other site read their data
• Headers and cookies — safety headers the site should send, and login cookies missing safe settings
• Weekly checks — on a Watch plan, LeakOwl checks again each week and emails when something new appears or a fix works

The scan makes about 30 safe, read-only checks. It only reads pages. It never logs in, sends attacks, or changes data.

Ownership proof

LeakOwl never scans a site before you prove you own it.

1. You paste your app's web address and an email.
2. You add one small file to the site (LeakOwl gives you a prompt so your AI tool can do it).
3. Only then does the free summary run.

Ownership is checked again at each scan. LeakOwl logs who ran it and when. That is so no one can scan an app that is not theirs.

How the report works

• The summary is always free. You see how many issues were found by severity (Critical, High, Medium, Low). No card needed.
• To see each issue, where it is, why it matters, and a fix step to paste into your AI tool, you pay first.
• Keys in the report are hidden. LeakOwl does not keep rows from your tables — only column names and counts.
• A clean result does not mean the app is fully safe. This is a quick check of what anyone can see from outside, not a full security test.

Pricing

Prices are in US dollars. Stripe handles payment. LeakOwl never sees your card. From leakowl.com/#pricing:

A plan is paid at the start of each month and covers the weekly checks that month. You can stop any time. LeakOwl only charges when you start a checkout or when a plan renews.

More

• Home / free scan
• How to hide API keys in a Lovable app
• Supabase RLS checklist for Lovable & Bolt apps
• Terms · Privacy · Acceptable use
• Support: support@leakowl.com