Find the leaks before the bots do.
We check your public GitHub repo for leaked API keys, security holes and bugs. Within an hour you get a score, the full list and a fix prompt for each problem that you can paste into Cursor or Claude Code.
- Your code is never run
- Deleted after the report
- Report within an hour
We're new and pre-launch, so there are no reviews or user counts to show yet. See the sample report.
-
The repo is public, and bots scan GitHub for keys within minutes. Deleting the line doesn't help because the key stays in git history, so rotate it.
FIX PROMPTMove the hardcoded OpenAI key in src/config.js into an environment variable OPENAI_API_KEY. Load it with process.env, add .env to .gitignore and create .env.example with a placeholder. Change nothing else. -
The delete endpoint never checks who is calling. A logged-out visitor can wipe accounts by changing the id in the URL.
FIX PROMPTIn routes/user.ts, protect DELETE /api/delete-user with the existing session middleware. Only allow deleting the logged-in user's own account and return 403 otherwise. Add a test. -
Search input goes straight into the SQL string. Someone can type SQL instead of a name and read or delete your tables.
FIX PROMPTRewrite searchScores in db/scores.ts to use parameterized queries instead of string concatenation. Keep the function signature unchanged. -
Any website can call your API with your users' cookies.
FIX PROMPTRestrict CORS in server.ts to the production domain from an ALLOWED_ORIGIN env variable. Keep credentials enabled only for that origin. -
fetchScores() has no error handling, so one failed request blanks the page.
FIX PROMPTAdd try/catch to fetchScores in src/api.ts and show an error state with a retry button.
Made-up repo, real report format. The buttons work.
Three mistakes AI coding tools make all the time.
Your assistant writes code that runs. It doesn't ask who else can call it.
Keys pasted into the code
We scan every file and the whole git history, so a key you deleted three commits ago still shows up.
// src/config.js export const openai = new OpenAI({ apiKey: "sk-proj-************3fA9" // leaked })
Routes with no lock
Endpoints that work for anyone, logged in or not. We list each one with the file and line.
// routes/user.ts:44 router.delete("/api/delete-user", async (req, res) => { // no auth check await db.users.delete(req.query.id) })
A fix you can paste
Every finding ends with a prompt written for Cursor or Claude Code. Paste it, then review the diff.
Fix prompt
Protect DELETE /api/delete-user with the session middleware. Only allow deleting the logged-in user's own account and return 403 otherwise. Add a test.Four levels from link to fixes.
- LEVEL 1
Paste the repo link
Any public GitHub repo. We check that it exists and is public before you pay.
- LEVEL 2
Try free, or pay $19 once
The free scan uses scanners only. The $19 report adds the AI review and fix prompts. Stripe checkout, no account.
- LEVEL 3
We scan it in a sandbox
Secret scan over the git history, static analysis, then an AI review. Your code never runs.
- LEVEL 4
Fix what we found
The report lands in your inbox as HTML and PDF, sorted in the order you should fix things.
What you get, in numbers we can show.
No user counts yet. These are the tools and limits we actually ship with.
- 4Open-source scanners: gitleaks, Semgrep CE with our own rules, Bandit, OSV-Scanner
- 23Our own Semgrep rules for auth gaps, injection, CORS and common AI slips, MIT-licensed
- 50Git commits of history we scan for keys that were "deleted" later
- $19One price, one repo, paid once. No account and no subscription
What a live-URL scan finds
Leaked keys in the frontend bundle, open Supabase tables, missing headers. Useful when the app is already online. Most vibe-coding scanners work this way.
What our repo check finds
Keys and bugs in the source and in git history, missing auth on routes, SQL built from strings. Useful before you ship, and for keys that never reached the browser.
We don't scan your live URL yet. If you only have a deployed app and no public repo, a URL scanner is the better fit today.
We read your code. We never run it.
We treat your repo as untrusted input, the way an attacker's code would be treated.
$ sandbox --network none --user nobody --read-only ok url github.com only, public ok clone shallow, size and time limits ok gitleaks files and git history ok semgrep security rules ok ai-review repo text treated as data done report sent, clone deleted
- Never executedNo install, no build, no tests. Scanners and the AI only read files.
- No network in the sandboxAnalysis runs in a container as a non-root user, on a read-only copy.
- GitHub links onlyWe accept https://github.com/owner/repo and nothing else, and check that it's public first.
- Prompt-injection guardHidden instructions in your files are ignored and reported as a finding.
- Secrets maskedKeys we find appear only partly in your report.
- Deleted afterThe clone is wiped as soon as your report is done.
Free teaser, or the full $19 report.
Same scanners either way. The paid report adds the AI review, every finding and a fix prompt for each one.
Scanners only. Score, counts by severity, one redacted sample finding. Cap 20 MB. Rate-limited.
Start a free scan- Scannersgitleaks, Semgrep, Bandit, OSV, package names
- AI reviewNot included
- Findings shownCounts + 1 sample
- Fix promptsNot included
- Email reportNot included
One repo, one check, paid once through Stripe. No account.
Insert coin- ScannersSame as free, plus AI review
- Findings shownEvery one, with file and line
- Fix promptsOne per finding
- DeliveryHTML and PDF by email, within an hour
- Private reposNot yet
- Human auditNot included
If we can't run your paid check, for example because the repo is private, you get your money back automatically.
Questions
Does a clean report mean my app is secure?
No. Leakcade is an automated check and it can miss vulnerabilities. It is not a substitute for a professional security audit or penetration test. The report is provided as is, and you stay responsible for your code and for any changes you make. Where the law allows, our liability is limited to what you paid ($19). Details are in our Terms.
Is there a free scan?
Yes. Paste a public GitHub repo and your email. We run the open-source scanners only (no AI), then show the score, how many findings we found by severity, and one sample finding with the details redacted. Fix prompts and the full list are in the $19 report.
Do you run my code?
No. We never install, build or execute anything from your repo. Scanners and the AI only read the files, inside an isolated sandbox with no network.
Does my repo need to be public?
Yes, for now. We check with GitHub that it's public before we clone it. Private repos are planned.
What languages work?
JavaScript/TypeScript and Python get the deepest review. Most common web stacks work. On very large repos we focus on the files that matter most and tell you what was skipped.
Is this a security audit?
No. It's a fast, AI-assisted first pass that catches the mistakes vibe-coded apps make most often. If real money or personal data depend on your app, get a human audit too.
What if the AI is wrong?
It can be. Every finding names the file and line so you can check it in seconds, and scanner hits are kept separate from AI judgement.
Do you keep my code?
No. The clone is deleted as soon as your report is generated.
What's the difference between free and $19?
The free scan runs gitleaks, Semgrep, Bandit, OSV-Scanner, the package-name check and the auth-route check. The $19 report does the same, then adds an AI review and emails you every finding with a fix prompt as HTML and PDF. Free scans are capped at 20 MB and rate-limited.
What if the check fails?
If we can't run your check (for example the repo is private, empty or too big) or we don't deliver a report within 24 hours, you get a full refund automatically. Details in our refund policy.
Can I get a refund after I get my report?
Reports are delivered instantly and can't be returned, so we don't offer refunds just for changing your mind. If your report is clearly broken or wrong, write to us and we'll review it.
Ready? Paste your repo at the top of the page.
Start with a free scan, or go straight to the $19 report.