LeakLock

LeakLock is a security tool that scans live websites and build outputs to find secret API keys.

LeakLock scans live websites, HTML, JavaScript bundles, lazy-loaded chunks, and public source maps to find exposed secret API keys that git-based scanners miss. It detects known keys from over thirty web and AI providers as well as unknown-format keys by analyzing how code uses them. The tool provides a verdict for each finding, categorizing them as critical, secret, review, or safe. It is designed for developers building apps with tools like Lovable, Bolt, Cursor, and v0. Users can run it in a browser, via the command-line interface, as a library, through a GitHub Action, or self-hosted on platforms like Railway, Render, or Fly.

LeakLock at a glance

Best for: Software engineer
Runs on: Web, CLI, GitHub Action, self-hosted
Pricing: Free and open source
Released: October 2026
Category: AI coding tool
Website: github.com/sgroy10/leaklock

Key features

Scans live websites and build outputs
Detects keys without known formats through code usage
Categorizes findings into critical, secret, review, and safe
Generates plain fix steps and AI-builder prompts
Runs as a command-line interface
Includes a GitHub Action to check pull requests
Offers a web checker

Use it for

Scanning live websites for exposed API keys
Failing pull requests when secrets are detected
Generating fix prompts for AI coding assistants
Checking build outputs before deployment

Alternatives to LeakLock

Varlock — It secures environment variables for both humans and AI agents.
Weir — It detects exact key values in agent logs and blocks them in coding sessions.
Sourcery — Automates pull request reviews and bug detection in GitHub and GitLab.
GitGuardian — Detects leaked secrets and insecure machine identities across your entire stack.
Hlock — Pins entire AI agent setups into a portable file to share and run anywhere.
DeepSource — Automated code reviews that combine static analysis with AI agents.
jevgrep — Reduces coding agent costs by providing targeted, relevant repository context.
SkillTotal — Scans code locally without accounts, telemetry, API tokens or executing the files.
guides.show — Explains code diffs in order of importance through portable, encrypted links
Coderblock — Builds full-stack web apps with React, backends, and databases from chat.
PullRequest — Combines AI risk analysis with vetted human experts to catch critical vulnerabilities.
Airlock: coding agents, kept contained — Isolates coding agents in a virtual machine and lets users review file diffs before applying changes.

All LeakLock alternatives