Buyer's guide · AI-built app security · Checked
Vibe-coded app security scanners compared
Free URL scanners such as ScanVibe, SafeToShip, Vibeproof and Prodable check a live Lovable, Bolt, v0, Cursor or Replit app in about a minute for exposed API keys, open Supabase or Firebase rules, missing security headers and exposed files, and they're a good first step for any vibe-coded app. Most free scans run as a logged-out visitor, so they can't confirm whether one signed-in user can read another user's data or reach paid features without paying. Run a free scanner first, then a code-level or human review before you take payments or store personal data.
Disclosure: ChikuOS sells some of the options below, and they're labelled "ChikuOS". No vendor paid to be listed or placed, and we earn no commission or affiliate fee from any link on this page. Prices and features of other products are as listed on their own sites on 18 October 2026; follow the links to check current terms.
Security scanners for AI-built apps compared (features and prices as listed by each vendor)
How we chose and ordered these: Live-URL scanners first, ordered by how much the free tier shows without paying, then scanners that read your code, then Lovable's built-in scans. What each tool checks is as the vendor describes it; we haven't benchmarked their accuracy. How we compare.
| Scanner | How it scans | Free tier | Paid | Notable |
|---|---|---|---|---|
| ScanVibe | Live URL, passive | Unlimited scans, all findings and fix prompts | Pro $9/month (monitoring, history) | Most generous free tier we found |
| SafeToShip | Live URL | Unlimited quick scans: score, finding titles and severity | Full report $9 one-time; unlimited $24/month | Cheap one-off full report |
| Vibeproof | Live URL or public GitHub repo, read-only | Instant scan, no signup | Deep scan $39 per scan | Free scan says it checks Supabase RLS and Firebase rules, live-verified keys, CVEs, SPF/DMARC |
| Bleek | Live URL | Free scan for exposed keys and public database tables | Deep Scan $19 one-time; Human Audit $300+ | One-time prices, no subscription |
| Prodable | Live URL, look-only | Graded scan, about 48 checks; email to unlock the full line-item report | Developer fix $499 flat | Scan plus a paid fix path |
| SecureYourVibe | Live URL | 1 scan per site, grade and top 3 findings | $5 full report; $9/month monitoring | Cheapest full report |
| Vibe App Scanner | Live URL, including signed-in permission tests | Free preview: score, all issue counts, one finding in detail | Go $19/month; Pro $39/month (adds weekly monitoring) | Says it tests access signed out, as the owner and as a different user, which most free scans don't |
| CheckVibe | Live app and your code | 14-day free trial | Starter $24/month; Pro $49/month; Max $99/month; teams $25 or $50 per seat | Code and live-app scanning with fix prompts and monitoring |
| Ship Safe | Open-source CLI on your code (MIT) | Free, runs locally | None needed for the CLI | Reads your repo, so it sees what URL scans can't |
| Aikido | Repo scanning (dependencies, code, secrets) plus 1 domain on the free plan | Developer plan free (2 users, 10 repos) | Paid plans and pentests scoped | Can connect to Lovable's Security view |
| Lovable built-in scans | Quick scan on publish; Deep scan of your code | Free, no credits | None | Lovable apps only. See Lovable scan vs audit |
How to choose
- Just launched, no logins or payments: one free URL scan (ScanVibe or Vibeproof) and fix what it flags. That may be all you need.
- Built on Supabase: add Supabase's free Security Advisor; see our Supabase security checker comparison.
- You have the code in GitHub: add a repo scanner (Ship Safe or Aikido's free plan) so secrets and vulnerable packages are caught before deploy.
- Users log in and data is private: you need a check that acts as a signed-in user, either a scanner that tests as a signed-in user (such as Vibe App Scanner's paid plans) or a human review.
What outside-in scanners can't see
- Cross-user access. Whether user A can read or edit user B's data needs two real accounts and real requests.
- Payment logic. Whether an order can be marked paid without a verified payment webhook isn't visible from the homepage.
- Admin routes hidden only in the UI. A hidden button isn't a locked route; testing it means calling it as a normal user.
- Intent. A public table may be fine (a product list) or a leak (customer orders). Scanners guess; you decide.
Prices in this market change fast, and some third-party "best scanner" lists still show older prices, so check each vendor's own pricing page; ours were checked on the date at the top of this page. Vendors' headline statistics (such as "70% of apps fail") are their own figures and we haven't verified them. Grades are a starting point: read each finding, because false positives happen.
Where ChikuOS fits
We aren't a scanner. Our $49 AI Site Audit is a developer reading your live app and writing the top 10 fixes across security, speed and SEO, within 24 hours. If a free scanner comes back clean and your app has no logins or payments, you probably don't need us yet. If you want the fixes done, see Audit + Fixes ($149). Worried about installed packages? The npm package scan ($49) covers that.
FAQ
What is the best free security scanner for a vibe-coded app?
For a live URL, ScanVibe has the most generous free tier we found (unlimited scans with all findings), and Vibeproof's free scan also probes Supabase and Firebase rules and verifies leaked keys. If your app is on Lovable, run Lovable's free Deep scan as well.
Are free security scanners safe to run on my app?
The ones listed here say they send only passive, read-only requests. Only scan apps you own or are authorised to test.
Can a scanner tell me my app is secure?
No. A clean scan means none of its checks failed. It doesn't prove signed-in users can't reach each other's data or that payment logic is sound. Treat it as a first pass.
Do these scanners work for Bolt, v0, Cursor and Replit apps?
The URL scanners above scan any live site, whichever tool built it. Lovable's built-in scans only cover Lovable projects.
When should I pay for a security review instead?
When the app takes payments, stores personal data, or users share data across accounts. That's when you want something that logs in as more than one user, either an authenticated scan or a human review.
How this guide was made: researched and drafted with AI assistance, then every price and claim was checked against the linked source on 18 October 2026. Editorial responsibility: ChikuOS. Spotted something out of date? Email hello@chikuos.com and we'll correct it.