LeakProbe

What is LeakProbe?

Developers ship secrets to production. AWS keys in JavaScript bundles, JWT tokens in URLs, .env files accessible from the web root, debug endpoints left open. LeakProbe scans everything publicly visible on a website - source code, headers, cookies, common file paths - and flags every leaked credential, token, and sensitive endpoint it finds. No authentication needed. If a browser can see it, LeakProbe catches it.

Features

• API key detection - Identifies exposed keys for AWS, Google Cloud, Stripe, Azure, GitHub, and 30+ other providers using pattern-specific regex.
• JWT token detection - Finds JSON Web Tokens in URLs, cookies, localStorage references, and inline scripts. Decodes headers to flag weak algorithms.
• Sensitive file checks - Probes for publicly accessible .env, .git/config, wp-config.php, and other files that should never be served.
• Hardcoded credential detection - Scans JavaScript bundles and inline scripts for hardcoded passwords, database connection strings, and internal URLs.
• Debug endpoint discovery - Detects exposed debug panels, stack traces, phpinfo pages, and status endpoints leaking server internals.
• Header analysis - Flags information-leaking response headers: server versions, framework identifiers, internal IPs, and misconfigured CORS.
• Free scan, paid monitoring - Instant one-click scan on any site for free. Paid tier adds continuous perimeter monitoring with alerting on new leaks.

Who is it for?

Built for security teams, pentesters, and DevSecOps engineers. Whether you are auditing your own perimeter or assessing a target - LeakProbe shows you what is already exposed to the entire internet.