PlugLeak is a free, passive security check for apps built with Lovable, Bolt, Cursor and Supabase. Paste your URL, get a score out of 100 in ~20 seconds, plus leaked API keys, public .env/.git and header/SSL issues. GET requests only; secrets masked. Automated check, not an audit. Scan is free; $9 one-time Fix Report (or $29 for 10) adds paste-ready fix prompts.
Scans HTML and all JS chunks for leaked keys
Detects Supabase service_role JWTs
Checks /.env and /.git exposure
Headers, HTTPS and SSL expiry checks
Score out of 100 with shareable report
Paste-ready fix prompts for Lovable/Bolt/Cursor
Check an AI-built app before launch
Verify no secrets leaked after a deploy
Get copy-paste fixes for your AI coding tool

Find your next favorite product or submit your own. Made by @FalakDigital.
Copyright ©2026. All Rights Reserved