LeakwatchBot

If you saw LeakwatchBot/0.1 (+https://leakwatch.tech/bot) in your logs, a Leakwatch user asked us to check a website for common security misconfigurations.

What we do

• Passive checks on any added site: we load the homepage like a browser and read its headers and cookies, check the TLS certificate, and look up public DNS records (SPF, DMARC).
• Path checks only after ownership is proven: requests to paths such as /.env, /.git/HEAD or /telescope are only made for sites whose owner added a DNS TXT record or a verification file.
• About 25 requests per scan, with a delay between them and a 10-second timeout.

What we never do

• No exploitation, logins, brute force, payloads or crawling.
• No storage of secret values. If a file like .env is exposed, we record only that it is reachable and the names of the variables in it.
• No connections to private or internal network addresses.

Opting out

Path checks can't run without the site owner's verification, so removing the verification record or file stops them. You can also block the User-Agent above.