For Lovable, Bolt, Cursor, v0 & Replit apps
Find the leaks before your users do.
Paste the URL of the app you shipped and prove the domain is yours. LeakSweep checks the public site for leaked keys, open data and missing protections, then hands you a fix prompt to paste back into the builder.
Want the deeper checks? Deep Scan, £29
LeakSweep runs an automated check. It is not a penetration test, a certification, or a guarantee that an app is secure. A clear report does not mean there is nothing else wrong.
Three steps. No call, no sales demo.
Built for people who shipped with an AI builder and want a plain answer before real users arrive.
- 01
Prove it's yours
Add a DNS TXT record or a one-line file under /.well-known/, and tick the authorisation box. The Computer Misuse Act check is enforced on the server.
- 02
Read the report
Each finding is plain English, with the evidence we kept (redacted) and a copy-paste prompt for the builder that made the app.
- 03
Watch it weekly
For £9 a month we re-run the deep checks every week. You get an email only when something new shows up.
What we check
The leaks AI builders tend to leave.
Passive requests only. No password guessing, no exploit payloads, and no customer rows stored.
- tls
Headers and HTTPS
HSTS, content security policy, framing, and the certificate.
- cors
Cross-origin access
Whether another website could read your site's responses with a visitor's cookies attached.
- files
Files that should be private
Only the paths this scanner requests.
/.env · /.env.local · /.env.production · /.git/HEAD · /.git/config · /package.json · /package-lock.json · /pnpm-lock.yaml · /yarn.lock · /bun.lock · /backup.sql · /dump.sql · source maps named by sourceMappingURL in served JavaScript
- keys
Secrets in public JavaScript
API keys that anyone opening the site can copy. We keep a redacted fragment, never the full value.
- data
Supabase and Firebase access
Whether the public key can reach tables it shouldn't. We count, we don't download. Deep Scan only.
Pricing
Start free. Pay when you want the full picture.
Quick Scan
Free
One scan of your public site
- —Headers, HTTPS and CORS
- —Exposed files and secrets in JavaScript
- —Plain-English report with fix prompts
Deep Scan
Before launch£29
One-off payment
- —Everything in Quick Scan
- —Supabase and Firebase access-rule probes, counts only
- —OSV dependency checks
- —A fix prompt on every finding
Monitoring
£9 / month
Billed monthly through Stripe
- —Deep checks re-run every week
- —An email only when something new shows up
- —Cancel any time from the customer portal
Every plan is an automated check, not a penetration test. Partial months of monitoring are not refunded. That billing line is a draft for legal review.
Notes · the newsletter
Short notes on shipping AI-built apps without leaking.
A weekly note on what we see go wrong, and the prompt that fixes it.
FAQ
Straight answers.
Is this a penetration test?+
No. LeakSweep runs an automated check of your public site. It is not a penetration test, a certification, or a guarantee that an app is secure, and a clear report does not mean there is nothing else wrong. If you handle payments, health data or anything sensitive, have a qualified person test it too.
Can I scan a site I don't own?+
No. The scan needs a DNS TXT record or a file at /.well-known/leaksweep-verify.txt, plus the authorisation tick. Both checks are enforced on the server. Nothing is requested until they pass.
Will a scan break my live app?+
The checks are passive. They read public pages, response headers, and row counts. They do not guess passwords, send exploit payloads, or store customer rows.
What happens to a key you find?+
Only a redacted fragment is kept: a short prefix and suffix. The full value is not stored in the report, the PDF, or the email.
Do I need to know how to code?+
No. Each finding includes a fix prompt you can paste into Lovable, Cursor, Bolt, or v0. You still decide what to ship.
What does the £29 Deep Scan add?+
Supabase and Firebase access-rule probes that store counts only, never row data. OSV dependency checks when a package manifest or lockfile is public. And a fix prompt on every finding.
What is the £9 monitoring plan?+
Once a week, LeakSweep re-checks that you still control the domain and runs the Deep Scan checks again. You get an email only when a new finding appears. Monitoring is £9 a month, billed monthly through Stripe. Cancel any time from the customer portal. A partial month is not refunded. This sentence is a draft for legal review.
Do you store my users' data?+
No. Row contents, document fields, and secret values are not stored. Reports keep a redacted snippet, a status code, or a count. See the privacy policy.