ShipWatch vs LeakPatrol: What Each Scanner Checks
LeakPatrol and ShipWatch both read your live app from the outside and hand you fix prompts. They overlap a lot, and they differ in a few places that matter. This page lays the checks side by side, taken from each product's own public page, so you can pick on facts.
Short answer: Both scan a live URL for leaked keys, an exposed .env or .git, and missing headers. LeakPatrol also advertises GitHub keys, n8n/Make/Zapier webhook links, source maps and, after you verify the site, a test of which Supabase tables anyone can read. ShipWatch does none of those four today. ShipWatch adds weekly monitoring on a dashboard from $19/mo.
Last checked October 20, 2026 against getleakpatrol.com and ShipWatch's own scanner code. Features change fast; corrections welcome at support@williamtstephens.com.
Why compare at all
If you built with Lovable, Bolt, v0, Replit or Cursor, the mistakes that hurt are boringly consistent: a secret key bundled into JavaScript, a .env served from the web root, a Supabase table with no Row Level Security. Every scanner in this niche goes after the same short list. The useful question isn't "which is best", it's "which of my risks does each one actually look at". So here's the list, check by check, no adjectives.
Feature table
Each row comes from the vendor's own page on the date above. "Not listed" means the page didn't say, not that the feature is missing.
| Check | ShipWatch | LeakPatrol |
|---|---|---|
| Input | Live URL | Live URL |
| Secret keys in page and JS | Stripe, OpenAI, Anthropic, AWS, Google | OpenAI, Anthropic, Stripe, AWS, GitHub and more |
| GitHub tokens | No | Yes |
| Supabase service_role key | Yes, plus sb_secret_ | Yes |
| Supabase tables readable without login | No | Yes, after site verification |
| n8n, Make, Zapier webhook links | No | Yes |
| Public .env and .git | /.env and /.git/HEAD | Yes |
| Public source maps | No | Yes |
| Security headers and HTTPS | CSP, HSTS, X-Frame-Options, nosniff, HTTPS redirect | Yes, with lines for your host |
| Result format | Report with fix prompts | A to F grade, fix prompts |
| Ongoing monitoring | Weekly, on the dashboard | Not listed |
| Price | Free scan; Solo $19/mo, Pro $49/mo | Free scan (£0); paid not verified |
Where LeakPatrol does more
Be clear-eyed about this, because these are real risks:
- Supabase table test. A leaked anon key isn't the problem; an open table is. LeakPatrol says that after you prove ownership it checks which tables anyone can read without logging in. ShipWatch doesn't do that today. You can do it by hand with one curl call, covered in Is the Supabase anon key safe?.
- Source maps. A public
.mapfile hands out your original source. ShipWatch doesn't look for them. - Automation webhook URLs. An n8n, Make or Zapier hook in your bundle can be triggered by anyone. LeakPatrol lists these; ShipWatch doesn't.
- GitHub tokens. In LeakPatrol's key list, not in ShipWatch's patterns.
If those four are your biggest worry this week, LeakPatrol's free scan covers more of them.
Where ShipWatch fits
ShipWatch is narrower on purpose. It reads your HTML plus up to 25 scripts and matches known secret-key formats: Stripe live secret and restricted keys, OpenAI, Anthropic, AWS access key IDs, Google API keys, Supabase service_role JWTs and sb_secret_ keys. It requests /.env and /.git/HEAD, checks four headers (CSP, HSTS, X-Frame-Options or frame-ancestors, and X-Content-Type-Options: nosniff), and confirms HTTPS with an HTTP-to-HTTPS redirect. That's the whole list. A Supabase anon key is reported as info, because it's public by design.
The difference is what happens next week. Apps built with AI change every time you prompt, and a key you removed on Monday can come back on Thursday. ShipWatch's paid plans re-scan weekly and show the changes on your dashboard. It doesn't send alert emails right now, so you check the dashboard.
How to choose
- Run more than one free scan. They're free and read-only. Two scanners with different rules catch more than one.
- If you use Supabase, test your tables either way. Use LeakPatrol's verified check or the manual curl in our Supabase RLS checklist.
- If you ship weekly, pick something that re-checks. A one-off scan is a snapshot of an app that keeps changing.
- Don't treat a good grade as an audit. Neither tool logs in, so neither sees what one signed-in user can read of another's data.
Keep watching weekly: Solo $19/mo ($190/yr) or Pro $49/mo ($490/yr), with results on your dashboard. Compare plans.
What the free scan checks here (and what it doesn't)
ShipWatch checks secret key patterns in your HTML and up to 25 scripts, Supabase service_role and sb_secret_ keys, /.env, /.git/HEAD, CSP, HSTS, X-Frame-Options, nosniff and HTTPS. It does not test Supabase tables, and it does not look for source maps, webhook URLs or GitHub tokens. For the other tools in this space, see ShipWatch vs Lockpick and the full scanner comparison.
FAQ
- Does LeakPatrol test Supabase tables and ShipWatch doesn't?
- Yes. LeakPatrol's homepage says that once you verify you own the site it checks which Supabase tables anyone can read without logging in. ShipWatch doesn't test tables; it flags a service_role or sb_secret_ key and notes the anon key as info.
- Which one finds source maps and webhook URLs?
- LeakPatrol lists public source maps and n8n, Make and Zapier webhook links among its checks. ShipWatch doesn't look for either today.
- What does ShipWatch cost compared with LeakPatrol?
- ShipWatch's scan is free; weekly monitoring is Solo $19/mo ($190/yr) or Pro $49/mo ($490/yr), shown on your dashboard. LeakPatrol's homepage shows a free scan at £0; we couldn't verify paid pricing, so we don't list it.