Free · no account · about 20 seconds
Is your app leaking anything? Check from the outside.
Paste your site’s address. You get a privacy score, the first three things to fix, and an exact count of the rest.
What it looks at
Secret keys shipped in your public JavaScript. Publishable and anon keys are expected and are not counted against you.
Supabase and Firebase data anyone can read without logging in, public .env and .git files, and source maps.
Which trackers and tracking cookies load before a visitor chooses anything, and what they can capture.
HTTPS, redirects, the headers browsers use to protect visitors, and cookie flags.
Version banners, error pages that show internals, open CORS, security.txt and a privacy policy link.
This check looks at your public website from the outside, as a visitor would. It does not read your code, log in, or test your database rules from the inside, and it is not legal advice. How the check works and how to opt out.