What it checks: Exposed API keys, tokens, JWT handling issues CORS misconfigurations and overly permissive cross-origin trust missing/weak security headers (CSP, HSTS, etc.) cookie security posture sensitive data leaking via local/session storage query/URL leaks and client-side state exposure source maps and build artifacts left exposed endpoint patterns from observed traffic
No reviews yetBe the first to leave a review for LeakFinder
Maker
📌
What it checks:
Exposed API keys, tokens, JWT handling issues
CORS misconfigurations and overly permissive cross-origin trust
missing/weak security headers (CSP, HSTS, etc.)
cookie security posture
sensitive data leaking via local/session storage
query/URL leaks and client-side state exposure
source maps and build artifacts left exposed
endpoint patterns from observed traffic
How it works:
scans DOM, network traffic, resources, and client state
correlates findings into actual risks (not raw data dumps)
scores everything by severity, confidence, and exploitability
Workflow inside the extension:
Findings → prioritized issues with risk scoring
Attack Surface → endpoints, headers, tech posture
Network → request-level data for review
Resources → client-side artifacts and state
Console + deeper runtime signals