Guide
What a public scan can see
This page matches the checks LeakWatch actually runs. It is not a customer story and not an audit report. Run a free scan of a site you have permission to test.
Lovable, Bolt, and Cursor apps
Once an app from Lovable, Bolt, Cursor, or a similar tool is deployed, it is a normal website. LeakWatch fetches that public URL. It does not connect to the builder, and it is not affiliated with those products. A fix prompt on a paid report is text you can paste back into the tool. It is not an integration.
Supabase anon keys and row level security
The anon key and the newer sb_publishable key are designed to ship in the browser. Seeing either is not a critical finding. LeakWatch treats it as critical only when a read-only request with that key gets a successful response from a table. The scan keeps the table name and throws the row away. A service_role JWT or an sb_secret key in client code is a privileged secret and is reported as critical even without a follow-up read. The scan never uses those keys to query the database.
Firebase rules
If the page contains a Firebase client config, LeakWatch sends one shallow read of the Realtime Database root and one Firestore list with pageSize 1. An unauthenticated success is the finding. Document bodies are discarded. A config with rules that deny the read is not reported as open. The AIza web API key that sits next to authDomain, projectId, or a firebaseapp.com host is public configuration and is marked info. A Google API key that is not part of that config stays high.
Public .env files
The scan requests /.env and /.env.local with GET. A response counts only when the body looks like environment assignments, not when the server returns an HTML page. The stored evidence is a short redacted snippet. Rotate every credential that was in the file, then stop the host from publishing it.
Secrets in JavaScript
The scan reads the HTML and up to 12 script URLs. It looks for credential-shaped strings such as live Stripe secrets, cloud tokens, and private keys. Publishable keys and placeholders are not treated as leaks. Values in the report are masked to the first four and last four characters. A free report hides that evidence for critical, high, and medium findings.
Source maps and other development files
Source maps are requested only for scripts found on the page, and only a short prefix is read. /.git/config and /config.json are on the same short path list. A missing file is the expected result and is not a finding.
Security headers
Missing Content-Security-Policy, HSTS on HTTPS, framing protection, nosniff, Referrer-Policy, or Permissions-Policy is recorded as low severity. Those notes are hygiene. They are not evidence that data was exposed.
What this scan does not do
It does not log in, submit forms, fuzz parameters, or test authenticated roles. A clean result means the supported checks found nothing, not that the application is secure. Monitoring on Starter or Pro repeats the same passive checks. It is not a penetration test and LeakWatch does not claim a certification.