Apps built with Lovable, Bolt, Cursor, v0 and Replit ship fast, and they ship the same security holes: keys in the browser, Supabase tables anyone can read, server actions anyone can call. Leakproof finds them and sends you the pull requests that fix them, for a fixed price.
A Supabase table created without Row Level Security can be read and rewritten by anyone holding the anon key, and that key is in your frontend.
NEXT_PUBLIC_OPENAI_API_KEY, VITE_STRIPE_SECRET: anything with a public prefix is shipped to every visitor. Someone else then pays your AI bill.
using (true) policies and Firebase if true rules look like security but let everyone in.
Server actions and API routes are public URLs. If they don't check who's calling and whether the record is theirs, anyone can curl them.
Change an id in the URL, get someone else's invoice. Insecure direct object references are the most common logic hole in generated CRUD code.
Unthrottled sign-up, password reset and AI endpoints become an open relay for spam and a surprise bill.
Open source, runs locally, and your code never leaves your machine. It catches the mechanical holes above in seconds.
npx github:beingRealFrank/leakproofAlso as a GitHub Action that runs on every pull request. Source and docs on GitHub.
A scanner can't see your live database settings, your business logic, or whether user A can read user B's records. That's what the audit is for.
For a pre-launch sanity check.
For apps with real users or real money.
Bigger codebase or a deadline? Ask for a quote. You pay only after we've confirmed the scope and price in writing.
AI agents do most of the reading, testing and fix-writing; that's why it's fast and affordable. A human, Frank Gilroy, reviews every finding and every pull request before it reaches you, and anything an agent can't reproduce doesn't go in your report. We only test systems you own and authorize, only against staging or read-only, and never modify or delete your data.
No. It's a focused code-and-configuration audit for the holes AI-built apps actually have. If you need a SOC 2 or a formal pentest letter, we're not that.
Best on JavaScript/TypeScript (Next.js, React + Vite, Remix, SvelteKit, Express) with Supabase, Firebase, Prisma or Drizzle, and on Python (FastAPI, Flask, Django). Ask if you're on something else.
It's used only for your audit and deleted when the engagement ends. Our access is read-only; we remove ourselves as a collaborator when done.
Then you get a report that says so, listing exactly what was checked, which is useful in its own right for investors, customers and your own sleep.