Is your AI-built app leaking data?

Seven security checks for apps built with Lovable, Replit or Bolt. Plain-English findings with a fix prompt for your builder.

See a sample report
Database
customersRLS off
bookingsRLS off
invoicespolicy allows anyone
profilesRLS on
API and keys
anon keyservice key in bundlecookie without Secureauth.uid()
Your app's screens
Home
Bookings
Account

Built for apps made with

  • Lovable
  • Replit
  • Bolt
  • Base44
  • v0
  • Lovable
  • Replit
  • Bolt
  • Base44
  • v0
Runs on Supabase, with code on GitHub.
checks, run in parallel
7
free rescan within 14 days
1
day limit on stored credentials
14
changes made to your app
0

Most AI-built apps ship with holes.

Non-engineers now ship apps that hold real customer data. Scanners find the first holes; nobody owns the rest.

63%

of 62 Lovable app scans by an independent researcher showed critical or high-severity findings. 77% of the apps ran on Supabase.

I scanned over 50 Lovable apps for security vulnerabilities, Medium
2,000+

vulnerabilities and 400 exposed secrets found across 5,600 AI-built apps, per a study cited in the same write-up.

Cited in the same Medium write-up
40%

of 5,000+ apps on Lovable, Replit, Base44 and Netlify that lacked basic security leaked private data, including medical and financial records.

Freevacy, summarizing WIRED's report on the RedAccess study

Watch a scan run.

This is the report the Full Scan delivers, playing its sample. Seven checks, a health score, every finding with its fix prompt.

Sample reportbookings.lovable.app
Health score
100
out of 100
Connecting
  • Secrets in code
  • Secrets in the live app
  • Database lints
  • Anonymous data probe
  • Passive web scan
  • Headers and certificate
  • Dependencies
Findings appear here

    Seven checks. One plain-English report.

    A Full Scan runs all seven in parallel and merges the results, so one issue found by two tools appears once.

    01Custom

    Secrets in code

    API keys, service keys and passwords committed to the repo, including old commits.

    Clones the repo read-only and scans files and the last 300 commits. Custom.

    02Custom

    Secrets in the live app

    Keys shipped to the browser, such as a Supabase service key.

    Downloads the live JavaScript bundles and matches known key patterns. Custom.

    03Custom

    Database lints

    Tables without row-level security, loose policies, exposed sensitive columns.

    customersRLS off
    bookingsRLS off
    invoicespolicy allows anyone
    profilesRLS on

    Reads the database catalog with the read-only role, never your rows. Custom.

    04Custom

    Anonymous data probe

    Tables anyone can read with the app's public key.

    Uses the public key from the bundle to request one row from each exposed table. Never writes or deletes. Custom.

    05Custom

    Passive web scan

    Missing security headers, insecure cookies, information leaks.

    Reads the live pages without attacking them: cookies, mixed content, public source maps and exposed files. Custom.

    06Custom

    Headers and certificate

    Missing basic headers, a certificate close to expiry.

    One request to the home page. Custom.

    07OSV.dev

    Dependencies

    Packages with known vulnerabilities.

    Reads the lockfile and asks the OSV database about every version. OSV.dev.

    Inside the report.

    The report is the product, so most of the design went into it. Every page answers one question an owner has.

    • 61
      2 critical1 high0 medium
      1/6

      A health score you can track

      One number from 0 to 100, with the count of critical, high and medium findings behind it.

      • CriticalService key shipped in the browser bundle
      • Critical3 tables readable without signing in
      • HighLogin cookie missing the Secure flag
      2/6

      Findings ranked by severity

      The worst problems come first. Two tools that find the same issue produce one finding, not two.

    • 3 tables readable without signing in

      customers, bookings and invoices answer to the public key with no row-level security.

      Who can reach it: anyone with the public key, no sign-in needed.

      3/6

      Every finding in plain English

      What is exposed, who can reach it, and what happens if nothing changes. No CVE numbers to decode.

    • In Supabase, enable Row Level Security on the customers, bookings and invoices tables. Add a policy on each table so a signed-in user can only select rows where user_id = auth.uid(). Keep the anon role from reading these tables. Then update the bookings screen so it requests only the current user's rows.

      4/6

      A fix prompt for your builder

      Paste it into Lovable, Replit or Bolt. It names the tables, the policies and the screens to change.

    • Web page, shareable link
      PDF for your records
      5/6

      A web page and a PDF

      Share the link with your developer or client, or download the PDF for your records.

      • Service key shipped in the browser bundleFixed
      • 3 tables readable without signing inFixed
      • Login cookie missing the Secure flagStill open
      6/6

      A rescan that proves the fix

      One click within 14 days reruns every check and marks each finding fixed or still open.

    From finding to fix prompt.

    LeakScan does not touch your app. It writes the instruction, and your builder makes the change while you watch.

    The finding
    Critical

    3 tables readable without signing in

    customers, bookings and invoices answer to the public key with no row-level security.

    The fix prompt, sample

    From order to report in seven steps.

    LeakScan never applies a fix itself. Every scan is read-only, so there is no need for write access, pull requests or SQL on your database.

    1. 1

      Order

      Pay at checkout, connect the repository with a read-only token, run one SQL snippet that creates a read-only database role, and paste the connection string.

    2. 2

      Verify

      Prove you control the domain with a DNS record or a file on the site. No check runs before this.

    3. 3

      Run

      A worker runs all seven checks in parallel and merges the results, so one issue found by two tools appears once.

    4. 4

      Explain

      LeakScan ranks every finding by severity, explains it in plain English, and writes a fix prompt you can paste into your builder.

    5. 5

      Deliver

      You get an email with a link to the report page and a PDF: a health score, the findings in order of severity, and the fix prompts.

    6. 6

      Rescan

      Within 14 days, one click reruns the checks and marks each finding fixed or still open.

    7. 7

      Clean up

      After the rescan or at 14 days, LeakScan deletes the stored credentials. The report gives you the one line of SQL that drops the database role and a reminder to revoke the GitHub token.

    Made for the owner who cannot read the code.

    If your app has real users and holds their data, this is for you. You do not need to know what row-level security is.

    A small business running a booking tool, client portal or ops app

    A leak or a lost database hits the business directly, and there is no developer on staff to catch it.

    A solo founder with paying users

    Revenue depends on the app staying up, and one breach is enough to lose the trust you earned.

    An agency shipping apps for clients

    Clients ask what happens after launch. A scan report under your brand is the answer.

    The quick test: the app has real users, it stores personal or payment data, and you cannot say whether row-level security is on.

    Scannerstellyouwhatiswrong.LeakScantellsyouhowtofixit.

    Your builder's own check

    Lovable runs a security check on every publish and offers a one-click AI review. Good for catching issues while you build, in the builder's own terms.

    External scanners

    Priced at $9 to $49 a month, they hand you a list of findings from the outside. The fixing, and the database, are still on you.

    LeakScan

    One price per app. It reads your database with a role you control, probes what the public key exposes, explains every finding in plain English and writes the fix prompt you paste into your builder.

    LeakScan never changes your app.

    Every check reads. Nothing writes. Here is exactly what LeakScan can and cannot touch.

    • Read-only code access

      A GitHub token that can read your repo's contents and nothing else.

    • A database role you create

      One SQL snippet makes a read-only role. The report includes the one line that drops it.

    • Passive scans only

      Your live app is scanned the way a visitor sees it, and only after you verify the domain.

    • Credentials deleted

      Encrypted at rest, fetched only by the job that needs them, deleted after the rescan or at 14 days. You can delete them earlier with one click.

    • Every action logged

      Each scan runs in a fresh container, and the report lists every action LeakScan took on your app.

    One price per app. No subscription.

    Full Scan

    Recommended
    $49one-time, per app

    Every check, the full report with fix prompts, one free rescan.

    • All seven checks
    • Health score and findings ranked by severity
    • A plain-English explanation of each finding
    • A fix prompt written for your builder
    • Report as a web page and a PDF
    • One free rescan within 14 days
    Scan my app
    Once.

    No plans, no seats, no monthly fee. Pay once per app, get the report, fix what it found, and rescan for free within 14 days.

    Launch pricing, shown in USD. The price may change before the public launch on November 22, 2026.

    Where this is going.

    These dates come from the build plan and move only if the gates before them slip.

    1. Now

      Private build, first real scans

      The seven checks run on the first apps while every report is read by hand. Every gap becomes a new check.

    2. November 15, 2026

      Full Scan on sale

      All seven checks with the report and one free rescan.

    3. November 22, 2026

      Public launch

      Terms, privacy policy and an outside security review of LeakScan itself, done before the doors open.

    4. After launch

      More builders and backends

      Firebase, Neon, Replit-hosted apps and Bitbucket, in the order customers ask for them.

    Questions owners ask first.

    Find out before your users do.

    Paste your app's address to start a Full Scan. Read-only, one price, report with fix prompts.