The leak class is real and Snyk/Socket genuinely ignore your-own-publish content, but the core check is free OSS and a pre-publish secret/source-map scan is a one-afternoon GitHub Action competitors will clone the moment it trends. Monetization hinges entirely on the thin CI org tier nobody has paid for yet. Small teams and solo maintainers will not pay a $50/mo B2B subscription for a CI check they can replicate with a 5-line bash script that unzips the tarball and greps for .map files.
PackLeak
SCALE · 70/100. Strong demand, a closing window, a clean wedge.
The leak class is real and Snyk/Socket genuinely ignore your-own-publish content, but the core check is free OSS and a pre-publish secret/source-map scan is a one-afternoon GitHub Action competitors will clone the moment it trends. Monetization hinges entirely on the thin CI org tier nobody has paid for yet. Small teams and solo maintainers will not pay a $50/mo B2B subscription for a CI check they can replicate with a 5-line bash script that unzips the tarball and greps for .map files.
Two small teams sign a paid $20-50/mo CI pilot for org-wide policy enforcement off the free CLI's traction, proving the paid tier exists above the commodity check. An engineering team currently paying for Snyk agrees to a paid pilot for PackLeak to explicitly cover their outbound tarball publish blindspot.
Claude Code's entire source code was reconstructed from a single stray .map file that shipped to the npm registry — the developer-forum thread hit 2,095 points and 1,022 comments, and a GitHub repo mirroring the recovered source pulled 8,700 stars and 14,348 comments. This isn't an edge case: modern build pipelines (esbuild, tsup, vite) emit source maps by default, so the exact failure that exposed a flagship product is one config slip away for everyone publishing to npm — and npm is load-bearing infrastructure (puppeteer-core alone does ~76M downloads/month). The tooling that exists checks…
SCALE at 70/100 on Skeptral. The kill-shot: “The leak class is real and Snyk/Socket genuinely ignore your-own-publish content, but the core check is free OSS and a pre-publish secret/source-map scan is a…”
8.5k upvotes across 5 real posts. Click any line and check it yourself.
The verdict above is the opening page. Behind it, this idea's dossier works through 11 more sections:
Your idea gets the same stress test, free. Run it now
Think yours survives?
Validate your idea, freeWant this depth on your own pitch? The full dossier is a €29 one-time order after your free verdict. Start with the verdict