Scanner
Replit security scanner
Paste the public URL of a Replit deployment. LeakWatch fetches that site the way a stranger would. It does not join the Repl, run your code, or sign in. LeakWatch is not affiliated with Replit.
The free report names every finding, with its severity and category. The most serious one is shown in full. The others keep the location, evidence, and fix prompt for the $19 Proof Report. One free scan per network every 30 days.
What this page is for
The public deployment
The scan starts from the URL you paste. A private Repl that is not deployed is not something this page can see.
Secrets in the page
Live API keys in the HTML or JavaScript are reported. Publishable and anon keys are noted, not treated as a leak by themselves.
Data left open
A readable Supabase table, an open Firebase database, or a public .env file is reported. The scan does not write to them.
Questions
- Can you scan the Repl editor?
- No. The check is the deployed website. If the app is not on a public URL, there is nothing for LeakWatch to fetch.
- Does the free scan use my one free scan?
- Yes. This is the same free scan as the homepage. The $19 Proof Report opens the locked details. Monitoring is a separate $9/month subscription.
A Proof Report is $19 once. Monitoring is $9/month. Pro is $29/month. No subscription is required for the report. See pricing.