MenuClose
API leak scan
Find APIs that leak data across users.
Routelint records the calls your vibe-coded app already makes, then replays each request with no session and as a peer account. Five suites run on every scan. Evidence is redacted before it is stored.
Who this is for
Teams shipping interfaces that talk to JSON APIs from the browser.
Use this scan when the risk is unguarded routes, cross-user access, secrets in responses, or forgotten debug paths—not how the marketing page scores in search.
Product teams
See which routes a new UI opened, and which of them still answer without a session.
Founders shipping fast
Run the same five suites after each deploy instead of assembling a one-off script.
Security-minded engineers
Review redacted evidence, suppress noise, and keep production scans opt-in.
Five suites
Every scan answers the same five questions.
The suites start from traffic the application already produced, then add a short probe of forgotten paths.
01
API catalog
See every XHR and fetch the running interface already made.
02
Unguarded access
Find routes that still return account data with no session.
03
Cross-user / IDOR
See whether a peer can read someone else’s objects with the same URL and body.
04
Secret and PII exposure
Catch tokens, cards, emails, password hashes, and stack traces in responses.
05
Sensitive paths
Probe forgotten paths such as /debug, /.env, and /actuator even when the UI never links to them.
How a scan runs
Capture the UI. Replay identities. Store redacted evidence.
Replay stays read-only by default. Findings stay attached to the suite that produced them.
01
Add a host you control
Paste the app URL, then prove ownership with a DNS TXT record or a well-known file. The scan stays on that host.
02
Record the live interface
A browser session follows the running app and keeps each XHR and fetch: method, query, body, status, and response.
03
Replay three identities
The same call is sent again with no session, as User A, and as a peer account. Forgotten paths are probed from a short list.
04
Review redacted findings
Tokens, emails, cards, and password hashes are stripped before evidence is stored. An account opens routes and severity detail.
Limits we keep
The scanner is useful because it refuses work it was not given.
These boundaries apply on every security scan, including the free trial.
Read-only by default
Replays use GET, HEAD, and OPTIONS. Destructive paths such as logout, delete, and checkout are skipped.
Verified host only
Private addresses and hosts outside the target are refused. Production runs ask for an extra confirmation.
Redacted evidence
Sensitive values are removed before a finding is written, so the report shows the category without storing the secret.
Questions
Before you start a scan.
A guest scan shows counts. An account opens routes, identities, and redacted evidence.
- What does one scan without an account show?
- Counts and severities for one free scan per browser. Titles, routes, and evidence stay on the server until you sign in and claim the scan.
- Do I have to prove I own the host?
- Yes. Publish the target token as a DNS TXT record, or at /.well-known/routelint-verification.txt. The public SEO check does not require this proof.
- Is this the same as the SEO and GEO check?
- No. This product records API traffic from a running interface and replays it across identities. The SEO and GEO check scores public HTML only.
Run one scan on a host you own.
Counts and severities without an account. Full evidence after you sign in.