One of seven checks in the Full Scan

Check your app's packages for known vulnerabilities

A typical AI-built app pulls in hundreds of open-source packages, and every so often one of them turns out to have a security hole. This check reads your lockfile and asks the public OSV vulnerability database about every exact version you use.

How the check works

LeakScan reads package-lock.json, pnpm-lock.yaml or yarn.lock from your repository, so it sees the exact versions installed, not just the ranges. It sends the package names and versions to OSV.dev, the open vulnerability database maintained with Google, and collects the advisories that match.

Ranked so you know what matters

Not every advisory affects your app. The report ranks them by severity, groups them by package, and names a fixed version to update to, so the fix prompt is a short list of updates rather than a wall of CVE numbers.

Common questions

Is this the same as npm audit?

It answers the same question from a different database, and puts the answer in plain English next to the rest of your app's findings.

Guides on this topic

The vibe coding security checklist: 12 checks before real users arriveA 12-point security checklist for apps built with Lovable, Bolt, Replit or v0. Keys, Supabase row-level security, storage, headers and packages, in plain English.Read more

Run this check on your app.

The Full Scan runs all seven checks in parallel, read-only, and gives you a fix prompt for every finding.