Terms & ethics

How we scan, and what we never do

Short version: only scan sites you own. We read public files, verify ownership before anything more, and keep nothing.

Only scan sites you own or have written permission to test. By using VibeLeakCheck you confirm that.

Passive scan

We fetch the public page and its same-origin JavaScript, the same files any visitor's browser downloads. We also request a fixed, short list of well-known leak paths on the same site (for example /.env, /.git/HEAD, /.DS_Store, /backup.zip), with GET only, no redirects followed and a 16 KB cap. A file is reported only when its content matches the real format, and we never show values from it (for .env files we show variable names only).

Active database check

Runs only after you prove ownership with one of: a meta tag on your home page, a token at /.well-known/leakcheck-verify.txt, or a DNS TXT record at _leakcheck.<your-host>. Tokens are tied to your exact origin and expire after 7 days. Ownership is re-checked on every run.

  • It uses the public anon key from your own bundle and sends read-only requests (HEAD or GET).
  • Table checks are count-only: we ask for limit=0 with an exact count, so no row is ever returned. We show table names, column names from your public schema, and counts.
  • It is rate-limited (3 runs per 10 minutes) and never writes, deletes or brute-forces anything.

No storage

Scan results live only in the HTTP response and your browser tab (sessionStorage). We do not keep copies. Any secret we show is redacted, and we never log found secrets.

No guarantees

A clean report does not mean your app is secure. This is a quick check of common mistakes, not a penetration test.

Found someone else's leak?

Don't use it. Tell the owner privately or report it to the platform (for example, the Supabase or Lovable security contacts). Misuse, such as scanning sites you don't own or trying to bypass the ownership check, is prohibited, and we block it.

Draft for the MVP: not legal advice. Review before public launch.