Security
LeakHunter is a local-first security scanner with no network dependencies. Transparency and verifiability are core to its design.
Architecture Overview
LeakHunter is a React Single-Page Application built with Vite and TypeScript. It runs entirely in your browser — there is no backend server, no database, and no external API dependency for its core functionality. The application can operate fully offline after the initial page load.
Scanning is performed using client-side JavaScript with regex pattern matching. The loaded patterns include over 130 signatures for detecting API keys, tokens, passwords, database connection strings, private keys, and other sensitive information.
Network Isolation
The scan engine makes no network calls. All file reading, pattern matching, and result rendering happens locally in your browser. There is no cloud processing, no API calls for secret detection, and no data transmission during or after scanning.
Scan Engine
- 130+ regex patterns covering AWS, Azure, GCP, GitHub, GitLab, Slack, Discord, Stripe, and more
- Three scan modes: Basic (file name), Standard (full content), Deep (expanded pattern set)
- Colour-coded risk levels: Red (critical), Amber (high), Yellow (medium), Green (low), Cyan (info)
- Drag-and-drop support for files and entire project folders
- Embedded Python CLI template for CI/CD pipeline integration
Code Transparency
LeakHunter is fully open source. The entire source code is available on GitHub. Every commit is publicly visible, and we encourage independent security researchers to audit the codebase.
Known Security Considerations
- Pattern matching may produce false positives — always review flagged results
- The embedded Python CLI requires Python to be installed separately
- Regex-based detection cannot catch all secret formats
- Large file scans may impact browser performance
Reporting a Vulnerability
If you discover a security issue, please report it privately via GitHub Security Advisories or contact Lidprex Labs at lidprex-labs.onrender.com.