Leak CheckSign in to runCoding · Leak Check
Leak Check
Find what your site gives away. Then find what a scan cannot see.
Checks a public page or a project folder for exposed files, keys and risky settings, and names the access checks that still need a signed-in test.
Creative and Pro plans.
What a visitor can reach
- Secret keys in the page and its scripts
- .env, .git or .DS_Store served in public
- CORS that lets any site read signed-in answers
- Strict-Transport-Security
- Content-Security-Policy
- X-Content-Type-Options
- Framing blocked (clickjacking)
- Public source maps
Run it on your preview before launch, and again on the live site.
What a visitor can reach
Eight checks, in plain words.
- Secret keys
- In the page and its scripts
- .env, .git, .DS_Store
- Served in public
- CORS
- Rules that let any site read signed-in answers
- Strict-Transport-Security
- Present, and long enough
- Content-Security-Policy
- What the page may load
- X-Content-Type-Options
- No guessing at file types
- Framing
- Clickjacking blocked
- Source maps
- Your source, readable in public
A scan sees what is open. It cannot sign in as your users, so it tells you which checks still need a real test.
Part of Creative and Pro.
Creative opens it, with Unslop and Launch Check. Pro opens it too.