Your app is leaking. We find it and ship the fix.

You built it with Cursor, Lovable or Claude. Before real users arrive, LeakFix scans your code and your live site for exposed keys, open databases and missing guards, then opens a pull request that fixes them.

example · my-saas.lovable.app Grade F · 3 critical

Supabase service_role key in the browser bundle

main.4f2a.js · full database access exposed

Critical

Table profiles readable by anyone

row-level security not enabled

Critical

No rate limit on /api/signup

open to abuse and cost spikes

Warning

HTTPS enforced, HSTS present

transport looks good

Pass

Example result · paste your URL above PR #1 · fix/leakfix-hardening

What we check

The holes that put vibe-coded apps in the news.

Most AI-built apps ship with at least one of these. A code scanner alone cannot see half of them, so we check the repository and the running site together.

Exposed secrets

Service keys, Stripe secrets and tokens shipped into the client bundle or committed to the repository.

Open databases

Supabase and Firebase tables with row-level security off, readable or writable by anyone.

Unprotected endpoints

Admin and debug routes, and APIs that trust the client to say who it is.

Missing rate limits

Sign-up, email and AI endpoints left open to abuse and runaway bills.

Headers and CORS

Absent security headers and CORS rules that let any origin call your API.

Input and auth gaps

Unvalidated input and authorization checks that were never written in the first place.

How it works

Three steps to a merged fix.

01

Connect

Install the GitHub app and paste your live URL. We confirm you own the app before anything runs.

02

Scan

Agents read the code and probe the live site, then rate each finding critical, warning or pass.

03

Fix

You get a plain-English report and a pull request with the fixes, reviewed by a second agent first.

The fix, not just the problem

Every finding comes with a diff you can read.

fix/leakfix-hardening · profiles RLS + key rotation

// app/lib/supabase.ts
- const supabase = createClient(URL, SERVICE_ROLE_KEY)   // shipped to browser
+ const supabase = createClient(URL, ANON_KEY)           // anon only on the client

-- supabase/migrations/0007_enable_rls.sql
alter table profiles enable row level security;
create policy "read own row" on profiles
  for select using ( auth.uid() = user_id );

Pricing

Start free. Pay when you want the fix.

Early-access pricing for everyone on the waitlist. Final prices may change before launch.

Quick check

Free

Paste a URL, get a 60-second read on the obvious leaks.

Exposed keys in the bundle
Open database check
Security header grade

Join to Try It

Launch checkMost picked

$49one-time

The full review of your repository and live site, plus the fix.

Everything in Quick check
Full code and live-site scan
Plain-English report
A pull request that fixes it

Get the Launch Check

Watch

$19per month

Stay safe as you keep shipping.

Re-check on every deploy
Automatic fix pull requests
Alerts when something slips

Join the Waitlist

Early access

Get on the list.

Join the waitlist and get a free quick check the day we launch. We email you once, when it is ready.