PlugLeak
Find leaked keys in your AI-built app in 20 seconds
FreeSecurityCode174 impressions#27 this week3 comments
Comments
>log in to comment- Aditya Goel· 11h ago
Useful for the Lovable/Supabase crowd, Juan. One question on how you score Supabase apps: the anon key is meant to be public, so finding it in the bundle isn't the problem by itself, the real leak is usually tables with RLS turned off that the anon key can read. Do you separate "anon key found (expected)" from "service_role found (critical)", and do you check whether a plain GET with the anon key returns rows from common tables like users or profiles?
Great question. Yes: PlugLeak decodes every Supabase JWT it finds, so an anon key is treated as expected and only a service_role key is flagged critical. We don't query your tables with the anon key yet, because even a read-only request against someone's database goes beyond a passive scan. That deep RLS check is coming, limited to verified owners. Until then, a quick manual test: logged out, GET https://<project>.supabase.co/rest/v1/profiles?select=* with only the anon key. If it returns rows, RLS is off on that table.
Day one for PlugLeak on DevHunt! Find leaked keys in your AI-built app in 20 seconds. Would love to hear how you'd use it, and what would make you switch.
PlugLeak scans live AI-built apps for leaked API keys, .env files, missing headers and HTTPS issues in about 20 seconds.
- for
- Developers of AI-generated web apps using Lovable, Bolt, Cursor, Replit or Supabase.
- pricing
- freemium
Key features
- Passive live-site scan — Loads the app like a browser and reads HTML and all JS chunks without logging in.
- Leak detection — Flags exposed Supabase service_role, Stripe, OpenAI, Anthropic, AWS keys and public .env/.git files.
- Security header check — Reports missing CSP, HSTS, clickjacking, nosniff and other headers.
- HTTPS & SSL validation — Detects missing redirects, invalid certificates and upcoming expiry.
- Masked evidence — Shows only first 6 characters of secrets; full values are never stored.
- Fix report — For $9 provides a copy-paste prompt for each issue tailored to Lovable, Bolt or Cursor.
- Email report link — Enter email to receive full problem list and a permanent report URL.
- Future monitoring — Planned weekly re-scans and after-deploy alerts via Vercel/Netlify/Lovable.
Use cases
- Validate a newly deployed AI-generated web app for accidental key exposure.
- Check a third-party AI-built demo before embedding it in your product.
- Run a quick security health check after each code push to catch new leaks.
PlugLeak vs alternatives
 PlugLeak |  Snyk |  Perfai Security |  Doppler | ||
|---|---|---|---|---|---|
| Best for | Quick passive leak detection for AI-built front-ends | Open-source secret and config scanning | Dependency and code vulnerability management | AI-prompted live vulnerability checks | Team secret management |
| Pricing | Freemium | Free | Subscription | Free | Subscription |
| DevHunt upvotes | 1 | 0 | 0 | 30 | 0 |
| Launched | Nov 2026 | — | — | Jun 2026 | — |
- PlugLeak vs Trivy: Trivy is an open-source scanner for vulnerabilities, misconfigurations and secrets in code and containers, not a live-site passive scan.
- PlugLeak vs Snyk: Snyk focuses on finding and fixing vulnerabilities in code, dependencies and containers, requiring integration into CI pipelines.
- PlugLeak vs Perfai Security: Perfai Security offers a one-prompt scan for live app vulnerabilities but is marketed as an AI-driven service rather than a dedicated leak detector.
- PlugLeak vs Doppler: Doppler manages secrets for teams and infrastructure, whereas PlugLeak only detects leaked secrets in deployed front-ends.
PlugLeak FAQ
Is it safe to scan my live app?+
Yes. The scan only makes GET requests a normal browser would make plus a single request to /.env and /.git/config; it never logs in or exploits anything.
Do you store my secrets?+
No. Secrets are masked (first 6 characters) before the report is saved and full values are never stored.
What does the $9 Fix report include?+
A copy-paste prompt for each finding written for Lovable, Bolt or Cursor, plus instructions on rotating keys and verifying the fix.
Why is an email required?+
The free score is instant; the email is used only to send the detailed report link and future monitoring notifications.
Can it check Supabase RLS policies?+
Not in the free scan; a deep RLS check for verified owners is planned for a future release.
Is this a full security audit?+
No. It is an automated check of what is publicly exposed and cannot guarantee overall app security.
Summarized by DevHunt from plugleak.com · Oct 31, 2026. Details may change; check the official site.
