free leak check

Is my Lovable/Bolt app leaking secrets?

Paste your app's URL. We load only what any visitor's browser loads (the page and its JavaScript) and flag exposed secret keys, public source maps and missing security headers. We don't store your URL or results, unless you ask us to email you the report (details).

Your app URL I own this app or am authorized to test it. The check is passive: no logins, no guessing hidden paths, and we never use any key we find.

Check my app

Limited to a few checks per hour. Keys we find are shown partly hidden. See the checker sections of our Privacy Policy and Terms. Site owners can opt out with User-agent: LockedVibeLeakCheck / Disallow: / in robots.txt.

Verify you own this domain (optional)

Verified domains get a Verified badge on results, longer key previews (first 12 characters, never full keys) and a higher hourly limit. It's the same passive scan. Verification lasts 30 days.

Get my verification code