Hey all, I'm the builder of LeakWatch, so full disclosure up front. I kept seeing the same story with AI-built apps: the app works, it launches, and then someone finds the Supabase table anyone can read, or a Stripe secret key sitting in the JavaScript. The AI said it was secure, and nobody checked from the outside. So I built a scanner that looks at your live app the way a stranger would: API keys and secrets exposed in your frontend code Supabase tables readable without logging in (RLS gaps) Firebase rules, a public .env, CORS, SSL and security headers It's free, read-only and needs no login. It only sends normal GET requests, the same as any visitor's browser. Every finding comes with a copy-paste fix prompt you can give straight to Lovable, Bolt or Cursor. The free manual check (no tool needed): log out, open your browser's network tab, and look for requests to /rest/v1/. Copy one, run it with no login, and if you get real rows back instead of [] or a permission error, that table is public. I'd love honest feedback, especially on what's confusing, what's missing, and whether the free tier is useful enough. getleakwatch.online   submitted by   /u/richlabstech [link]   [comments]