Privacy & responsible use

LeakyVibe runs passive, read-only checks against the URL you submit: it downloads the page, a few same-origin JavaScript bundles (size-capped), and makes a tightly limited number of requests (e.g. /robots.txt, /sitemap.xml, /.env, /api, the http:// version of your domain to see if it redirects to https, up to 20 links on your homepage and — if your page exposes a Supabase URL with its public anon key — a few GET reads of at most 1 row). We also look at your security headers and your page title/description.

If a table turns out to be readable we note only its name and column names; we never store or display row contents. No AI reads your site.

Only scan apps you own or have permission to test. We do not brute-force, fuzz or write any data.

We don't store your code, HTML or the secrets we find: reports are generated on the fly and evidence is redacted. If you leave your email or buy a report, we store your email, the scanned URL and the summary in our CRM to send you results and updates. You can unsubscribe any time.

If you buy the 10-report pack, we store a signed cookie in your browser that identifies your purchase (to count your credits). Used credits are recorded in Stripe as a short hash of the unlocked URL.

Payments are processed by Stripe; we never see your card details.

LeakyVibe is not a substitute for a professional security audit.