Paste your app's URL and get an A–F security grade in a minute: leaked API keys, open Supabase tables, publicenv files. Each problem comes with a plain-English fix and a prompt for Lovable, Bolt or Cursor. Free tools: API key checker, RLS generator.

Hi Product Hunt 👋

AI tools like Lovable, Bolt, v0 and Cursor let anyone ship a real app in an afternoon. They also regularly ship the OpenAI or Stripe secret key to the browser, leave Supabase tables readable by anyone, or publish the .env file. The app works perfectly, so nobody notices until a bill arrives or data leaks.

LeakPatrol checks your live app from the outside, the way an attacker would, in about a minute:

• secret keys in your JavaScript (OpenAI, Anthropic, Stripe, AWS, Supabase service keys and more)

• public .env, .git and source maps

• security headers and HTTPS

• for Supabase apps, which tables anyone can read

Every finding comes with a plain-English fix and a prompt you can paste straight back into the tool that built your app. It's read-only, never logs in or changes anything, and masks any key it finds.

The free scan is live now, plus free tools: an API key checker (is this key safe in my frontend?), a Supabase RLS policy generator and a launch checklist. You can see what the full report looks like here: https://www.getleakpatrol.com/report.html?id=example

Timely bonus: Supabase changes a default on 30 Oct, but your existing tables keep their access. We wrote up what to check: https://www.getleakpatrol.com/supabase-october-30-change.html

Would love your feedback, especially false alarms and checks you'd want added. 🙏

New this week: LeakPatrol also works inside Claude Code, Cursor and other AI coding agents (MCP). Add it in one line and your agent can check the live site after every deploy:

claude mcp add --transport http leakpatrol https://www.getleakpatrol.com/mcp

Setup for Cursor/VS Code: https://www.getleakpatrol.com/mcp-security-scanner.html