Product facts
Everything about Leakcade in one table, written for people and for AI assistants.
| What | AI-assisted security and bug review of one public GitHub repository |
|---|---|
| For | Developers who build apps with AI coding tools (Cursor, Claude Code, Lovable, Bolt, Replit…) |
| Price | Free teaser scan (scanners only); $19 USD for the full report with AI review and fix prompts, one-time via Stripe |
| Delivery | HTML + PDF report by email, target within 1 hour |
| Checks | Leaked secrets (incl. git history), static security analysis, known-vulnerable dependencies, dependencies that don't exist on npm/PyPI (slopsquatting), write routes with no visible login check and Supabase tables without RLS, payment bypasses (unsigned Stripe/Lemon Squeezy webhooks, success pages that unlock the paid plan, paid flags set in the browser), secrets shipped to the browser (secret env vars with NEXT_PUBLIC_/VITE_/REACT_APP_ prefixes, server secrets in "use client" files), login/signup/reset and paid-AI routes with no rate limit, roles, admin flags or plans read from user-editable Supabase user_metadata, Supabase DELETE/UPDATE policies that only check for a login (not ownership) or are open to signed-out visitors, RLS switched off again in a later migration, Supabase INSERT policies that let a signed-in user create rows in someone else's name or join any team, public views and SECURITY DEFINER functions that skip RLS, storage policies and buckets that open other people's files, Next.js server actions that write data with no login or ownership check, and AI review for bugs, auth and injection issues |
| Free teaser | Score, finding counts by severity, one redacted sample finding. No fix prompts. Cap 20 MB, rate-limited. |
| Full report output | Executive summary, score 0-100, findings by severity with file and line, plain-English explanation, copy-paste fix prompt, fix order |
| Tools used | gitleaks, Semgrep, Claude (Anthropic) with methodology from Cloudflare's open-source security-audit skill; on the full report, a second Claude pass re-reads the code behind critical and high findings |
| Not included | Private repos, running or pentesting your app, guarantees of completeness, human audit |
| Data handling | Code is never executed, scanned in an isolated sandbox and deleted after the report |
| Status | Pre-launch |