A website security scanner that tests the app you already shipped

LeakRank is a free website security scanner. Paste the URL of a deployed app and it fingerprints your backend, then checks what leaks real user data: Supabase tables with row level security off, public Firebase rules, API keys in your JavaScript bundle, exposed .env files, missing security headers. Results in about 30 seconds, no signup.

Coverage

What this website security scanner checks

Every scan starts from your public URL. LeakRank fetches your HTML, follows up to 12 of your JavaScript bundles, fingerprints the backend behind them, and then runs the checks below with nothing a stranger does not already have.

Database exposure

On Supabase the scanner asks your REST API for its table list using the public anon key your app already ships, then reads the first rows of up to 8 tables. A table that answers is a table with row level security off, and it is named back to you as public.orders or public.profiles with a row count. On Firebase it reads the collections apps almost always have, users, profiles, customers, orders, messages and posts, plus your Realtime Database, with no token at all.

Keys in your client bundle

Your HTML and bundles are searched for credentials that should never reach a browser: sk_live_ Stripe keys, AKIA AWS keys, sk-ant- and sk-proj- AI keys, ghp_ and github_pat_ tokens, npm_ tokens, SG. SendGrid keys, xox Slack tokens, AIza Google keys, database URLs with a password in them, and any Supabase JWT whose payload decodes to role service_role. Matches are masked before they are shown.

Response headers and cookies

Content-Security-Policy, Strict-Transport-Security, X-Frame-Options or CSP frame-ancestors, X-Content-Type-Options and Referrer-Policy. Every Set-Cookie is read for HttpOnly, Secure and SameSite, because a session cookie without HttpOnly turns one injected script into a full account takeover. The scanner also sends an unknown Origin header to see whether your CORS policy reflects it back and still allows credentials.

File storage

Supabase Storage is asked to list your buckets with the public key. If it answers, a stranger learns the names of your private buckets too, and any bucket flagged public is reported on its own line. On Firebase the scanner tries an unauthenticated object listing against your-project.appspot.com and your-project.firebasestorage.app.

Deploy hygiene

Twelve paths that should never be served are requested directly, including /.env, /.env.local, /.env.production, /.git/config, /.aws/credentials, /.npmrc, /dump.sql, /backup.sql and /.DS_Store. Your first 3 bundles are checked for a matching .js.map, because a published source map hands over your original, unminified source.

DNS and email policy

SPF, DMARC and CAA are read from your domain's public DNS, and are only judged when the domain publishes MX records, so a website-only domain is never penalised. A DMARC set to p=none monitors and enforces nothing. An SPF ending in +all authorises every sender on the internet. Supply a DKIM selector and that key is checked as well.

Unauthenticated API routes

When there is no Supabase or Firebase client to fingerprint, the scanner pulls /api/ paths out of your bundle and calls up to 12 of them with no session. A route that answers 200 with record arrays or fields like email, token, phone or address is reported. A route with an id placeholder is called with a concrete id, which is how a missing ownership check shows up.

The stacks it fingerprints are Supabase, Firebase, Convex, Clerk and plain custom APIs. Supabase and Firebase get the deep database probe. Convex, Clerk and custom backends get the API route probe, and every stack gets the header, cookie, CORS, secret, deploy and DNS checks.

Free scan vs Fix Pack

What the free scan returns, and what the Fix Pack adds

The free result tells you which area is broken. The Fix Pack tells you which table, file, route or header, and what to paste to close it.

Free, no account for your first scan

  • A score from 0 to 100, a letter grade and a verdict
  • Which areas are affected and how many findings sit in each: database exposure, leaked secrets, auth and endpoints, transport and headers, cookies and sessions, CORS, file storage, deploy hygiene, DNS and email
  • How many findings are critical, high, medium and low
  • The stack we fingerprinted, and the list of checks you passed
  • One finding revealed: the area it is in and what it costs you, without the location

Scoring is fixed and public: start at 100, lose 30 for a critical finding, 15 for a high, 7 for a medium, 3 for a low, floor of 0.

Fix Pack, $29 once

  • The exact table, file, route, header or key behind every finding
  • A copy-paste fix prompt for Cursor or Claude Code
  • PDF report plus a verified badge you can embed
  • Free re-scan (1/day) to verify the fix
  • First month of Guard free ($19 value)

30-day money-back guarantee.

Fix guides

Read the fix for what the scan finds

Grading headers on their own is a separate free tool: security headers check. Everything else we have written lives in the security guides.

FAQ

Questions people ask before they scan

Is the website security scanner free?

The scan, the score and the affected areas are free, and the first scan of a site needs no account. You pay only for the Fix Pack, $29 once, which names the exact table, file, route or header behind each finding and gives you the fix. 30-day money-back guarantee.

Do I need to install anything or connect my repo?

No. The scan runs from your public URL, the same way any visitor reaches your app. Nothing is installed, no repository access is requested, and no keys are asked for. Re-scanning a site that has already been scanned from your connection needs a free account.

Will the scan write to my database or break my site?

A public scan only reads. It issues GET requests using the public keys your app already hands to every browser. The write test, which checks whether a stranger can insert or delete rows, runs only against a domain whose ownership you have verified, never against a URL somebody typed in.

Does it scan my source code or my live site?

Your live site. It fetches your deployed HTML, follows up to 12 of your JavaScript bundles, reads your response headers and DNS, and talks to the same public endpoints a visitor's browser can reach. For continuous scanning of your repository as you write it, that is LeakRank Guard.

How is the security score calculated?

Every scan starts at 100 and loses 30 points for a critical finding, 15 for a high, 7 for a medium and 3 for a low, with a floor of 0. The score, the grade and the affected areas are shown for free on the result page.