Vibe-Code Rescue — free leak-check implementation receipt
Reviewed: 2026-10-31
Implementation: src/lib/leak-check.mjs
Repository revision inspected: c28efd97824ac76354673a7b8635fd4702f4c009
Scope: the free scan, not the paid deep report.

leakCheck fetches one supplied public HTTP(S) URL, following at most three
redirects. Private addresses, credential-bearing URLs and nonstandard ports
are rejected. The scanner reads HTML; it does not run a browser or JavaScript,
sign in, traverse routes, inspect a repository or call providers to validate
matched credentials.

Limits: MAX_HTML_BYTES=750000; MAX_SCRIPT_BYTES=750000; MAX_SCRIPTS=8;
TIMEOUT_MS=10000. Script URLs come from HTML script src attributes and
modulepreload/preload-as-script links. Only initially same-origin script
URLs are selected; each fetch may follow public redirects. Duplicate paths
are removed. Script text is scanned, but imports are not recursively followed.

Patterns: JWTs whose decoded JSON payload has role service_role;
sb_secret_ strings; sk_live_/sk_test_/rk_live_/rk_test_ Stripe strings;
sk-ant- Anthropic strings; sk- non-Anthropic strings; AKIA AWS access-key IDs.
These are pattern matches, not confirmation of validity, permissions, account
ownership or exploitability. AWS's standard EXAMPLE access-key ID is excluded.
The matching expressions include minimum lengths and permitted characters;
formats outside those expressions may be missed. A matched prefix is the
first six characters followed by an ellipsis. Repeated matches are deduplicated.

Headers: headerFindings checks for nonempty Content-Security-Policy,
Strict-Transport-Security and X-Frame-Options values in the fetched page
response. It does not parse or validate their policies.

Result: checked identifies the fetched origin/path (without the query string,
and reduced to the origin for certain sensitive-looking paths).
scriptsChecked counts fetched scripts scanned. scriptsSkipped starts with
URLs beyond the eight-script cap and increments for failed script fetches.
A timeout may stop iteration before remaining scripts are counted as skipped.
truncated reflects HTML truncation only. Each script is also capped, but
script truncation is not returned as a separate field. timedOut reflects
whether the timeout signal has fired. These fields are coverage information,
not a security certification.

Scope exclusions include credentials only available after login, dynamically
loaded code not listed in the fetched HTML, routes not submitted, backend
source and configuration, formats not covered by detection expressions,
and content beyond read/time limits.