One of seven checks in the Full Scan

A passive web security scan that never attacks your app

Some problems are visible to anyone who loads your site: a login cookie that can travel over plain HTTP, a source map that reveals your code, a forgotten .env file or .git folder. This check reads your live pages the way a visitor would and lists what it sees.

What this check looks for

  • Session cookies missing the Secure, HttpOnly or SameSite flags (Supabase's own auth cookie is readable by the browser on purpose)
  • Public source maps that publish your original source code
  • An exposed .env file or .git folder
  • Mixed content: scripts or images loaded over plain HTTP on an HTTPS page
  • Headers that advertise your server software and its version

Passive means safe

The scan sends only the requests a browser would send. It does not try passwords, inject code or flood your server. It runs only after you verify the domain, so nobody can point LeakScan at an app they do not own.

Common questions

Is a passive scan enough?

It finds what is visible from the outside. That is why the Full Scan pairs it with checks on your code, your database settings and what the public key can read.

Run this check on your app.

The Full Scan runs all seven checks in parallel, read-only, and gives you a fix prompt for every finding.

The other six checks