About this scanner

Each scan fetches the public page, the script URLs that page references (up to 12), and a short list of paths: /.env, /.env.local, /.git/config, /config.json, and source maps next to those scripts. It reads the homepage response for security headers, cookie flags, and a CORS wildcard combined with credentials. For an https URL, after the host has passed the private-network checks, it opens one TLS connection and reads the certificate expiry. That handshake is not an HTTP request.

If a Supabase URL and an anon or sb_publishable key are present, it sends GET requests with limit=1. Column names such as email, phone, address, or date of birth raise a readable table to critical. Row contents are not stored. An sb_secret key or a service_role JWT is reported and is not used for that request. If a Firebase config is present, it sends one shallow Realtime Database read and one Firestore list request. A Firebase web API key beside that config is recorded as public configuration. It never sends POST, PUT, PATCH, or DELETE to your app, and it does not log in.

Each request times out after 8 seconds. Private IP addresses, localhost, and cloud metadata hostnames are refused. Redirects are checked again before they are followed. An operator allowlist exists only for a local demo and must stay empty on a public server.

A free scan requires an email and drops any query string from the URL. One free scan per network every 30 days. The free report names every finding, with its severity and category. The most serious one is shown in full. The others keep the location, evidence, and fix prompt for the $19 Proof Report. Monitoring runs only after you place a verification token on a site you add to a paid account.

A Pro account can connect one GitHub repository to a verified app. That check is separate from the URL scan. It reads package versions, the latest 150 commits, and a few source patterns, then deletes the clone. A checkout larger than 256 MB is skipped. The repository is not stored. The homepage scan does not clone anything.

If this traffic is unwelcome, block the User-Agent. Questions and vulnerability reports: support@getleakwatch.online.