Last updated: October 26, 2026.
LeakFix ("we", "us") provides a passive, read-only security and launch-readiness scan of a public URL you submit. By using the service you agree to these terms.
You may only scan apps you own or have written authorization to test. Checking the consent box is a binding representation of that fact. Unauthorized scanning is prohibited and grounds for immediate termination and, where applicable, referral to the site owner.
We fetch the public HTML of the URL, its same-origin JavaScript bundles, and a short list of well-known public paths (/.env, /.git/config, robots.txt, sitemap.xml, source maps). When your page already exposes a Supabase or Firebase configuration, we make read-only probes (HEAD / OpenAPI / shallow JSON) using those public credentials. We never attempt logins, never write data, and never store database row contents.
Unlocks are one-time payments processed by Stripe. See the refund policy for the 7-day no-questions guarantee.
Scans are best-effort snapshots. A clean score is not a guarantee your app is secure. LeakFix is not a substitute for a professional penetration test or code review. We are not liable for damages arising from reliance on a report, to the maximum extent permitted by law. Our total liability for any claim is limited to the amount you paid us for the relevant report in the 30 days before the claim.
No scanning of targets you don't own, no automated bulk scanning beyond the published rate limits, no attempting to bypass paywalls or extract other users' reports, no abusing the service to attack or overload third parties.