Leak Check Agent + sandbox on Vultr

Find the leaks in your AI-built app before someone else does.

Apps made with Lovable, Bolt and other AI builders often ship with open database tables, public invoice files, or a master key sitting in the page code. Leak Check's agent writes the tests itself, runs every one in a locked sandbox, and shows you the proof.

Optional: your public (anon) key

The agent can find the public key in your app's code on its own. If you'd rather give it, paste the anon key from Supabase (Settings → API). Never paste the service_role key.

Prove you own it

Leak Check only tests apps whose owner proves control. Get your token, then serve it as plain text at /.well-known/leak-check.txt on your app. The demo shop already has one.

Read-only: the agent only sends GET requests, at most 25 per test. Personal data and keys are masked before the AI or this page ever sees them.

1. SealA fixed script tries to break out of the sandbox first. If any wall fails, nothing else runs.
2. LookThe AI writes a script that reads your public pages and JavaScript.
3. TestIt plans the checks and writes one script per check. Each runs in a fresh gVisor sandbox that can reach only your app.
4. ProveIt reads the real output and reports what leaked, the evidence, and the fix.