An apparatus reads a chip design comprising first and second blocks corresponding to first and second hardware modules, nodes, and data path segments that each connect a pair of nodes or a node to a block. Tracing backward along data paths that terminate at the second block, the apparatus identifies a secure cone. The secure cone comprises secure path segments of the data paths terminating at the second block and corresponding nodes. The apparatus identifies data paths originating at the first block and that are at least partially within the secure cone and determines whether any terminate outside the secure cone. When none of the data paths originating at the first block terminate outside the secure cone, the apparatus verifies the chip design. When a data path originating at the first block terminates outside the secure cone, the apparatus determines that the chip design has a potential leak.