Best security scanner for vibe coded apps: what each tool sees

Updated Oct 31, 20269 min read

There's no single best security scanner for vibe coded apps, because each tool reads a different part of your app: the live site, the code, the git history or the database rules. Here are 12 tools, what each sees and costs, and a free stack to start with. Prices come from each vendor's page on Oct 31, 2026. We make Leakcade, one of the 12, so check the sources.

Short answer: which security scanner for vibe coded apps?

Start with the free scans that already come with your tools, then add one outside view. For a typical Lovable, Bolt or Cursor app on Supabase that means:

1. Your builder's own scan: the Lovable Quick and Deep scan or Bolt security audit.
2. The Supabase Security Advisor on your live database.
3. A secret scan over the whole git history, with GitHub secret scanning (free on public repos) or gitleaks.
4. One check from outside: the ZAP baseline scan or a hosted URL scanner, plus a test with two accounts.

Pay for a hosted scanner when you want one report across several layers, scheduled re-scans or fix prompts. Pick it by what it reads.

Four places a scanner can look

Vibe coding security tools are hard to compare because they read different things. A scanner can look at four places:

• The live site: the JavaScript bundle, headers, cookies and files like /.env. URL scanners look here.
• The code: routes, server actions, Edge Functions, SQL built from strings. Repo scans and builder code reviews look here.
• The git history: keys you pasted and deleted are still in old commits. Only tools that read commits see them.
• The live database rules: policies set in the Supabase dashboard, which can differ from your migrations. The Security Advisor and builder scans look here.

More on the first two in repo scan vs URL scan.

12 vibe coding security tools side by side

From each vendor's own page, checked Oct 31, 2026. Prices change, so check before you buy.

Free scans built into Lovable, Bolt and Supabase

• Lovable security scan. The Quick scan runs every time you publish and reviews database access rules, known critical vulnerabilities in npm packages and an MCP server exposed without a login. The Deep scan reviews your app code for access control, open endpoints, injection, leaked secrets, payments and sign-in, but only when you start it. Running both is free. Lovable's docs say the tools "cannot guarantee complete security". See Lovable security scan vs Leakcade.
• Bolt security audit. The project audit reviews code and database, fixes what it can and lists what you must change yourself. It's on paid plans, doesn't use tokens when you start it from the Publish menu, and is capped at 30 audits a day. A lighter database check runs on all plans. See Bolt app security.
• Supabase Security Advisor. Deterministic checks on your live project, run from Studio, the CLI (supabase db advisors) or MCP. It flags tables with RLS off, policies with USING (true), views that skip RLS and security definer functions anyone can call. Supabase warns that some findings may be intentional.

These three see your real configuration. None of them looks at the live site the way a stranger does, and the tool that built the app is also the one checking it.

Free open source and GitHub tools

• GitHub secret scanning. On public repos it runs automatically and for free, across the entire git history on all branches. On private repos it's part of a paid add-on. GitHub's advice when it finds a key: rotate it right away.
• gitleaks. MIT-licensed CLI. gitleaks git scans every patch through git log -p, and gitleaks dir scans files. Our guide to finding secrets in git history has the commands.
• Semgrep. Static analysis for injection, XSS sinks and risky APIs. The CLI runs on your machine, and Semgrep's docs say code is not uploaded, only findings.
• ZAP baseline scan. Spiders your site for a minute, then reports what passive checks found: missing headers, cookie flags, error pages. ZAP's docs say it doesn't perform any actual attacks. It knows nothing about Supabase.

Hosted scanners made for AI-built apps

• Aikido. Connects to your GitHub repos and scans code, packages and secrets. The free Developer plan covers 10 repos, 2 users, 1 domain for its DAST scan and 10 AI AutoFixes a month, with rescans every 3 days.
• CheckVibe. Scans the live site in a real browser, a connected repo and, on paid plans, a connected Supabase project's tables, policies and buckets. Starter is $24 a month, Pro $49 with daily monitoring, and every plan starts with a 14-day trial. A free account scans your site and code but masks part of each findings list.
• Vibe App Scanner. Your first URL preview is free and shows a score, counts and one finding. Go is $29 a month (20 live-app scans, 10 repo scans), Pro $49 with weekly monitoring. Repo scans need a paid plan.
• SniffPup. A passive scan of your published URL, including whether an anonymous visitor can read rows in a few Supabase tables. The scan is free, a one-time Full Fix Report is $9, and plans with daily re-scans start at $7 a month. The full check of a public GitHub repo is in the paid plans.
• Leakcade (us). Reads a public GitHub repo as text: gitleaks over the files and the last 50 commits, Semgrep, OSV-Scanner, a check for made-up package names, our Supabase migration checks, and an AI review in the paid report. The free teaser shows a score, counts and one redacted finding. The full report is $19 one time, and we're pre-launch.

What no scanner catches on its own

The most useful public test we found is BuildWithThis's, run on Oct 16, 2026. They planted 10 holes in one small Supabase app and ran six tools. The best single tool caught 4.5 of the 10, and all six together caught 7.5. None of the six flagged a policy that let any signed-in user read and edit every profile, or an Edge Function with no login check. It was one small test app, so read the numbers as a rough signal.

A policy that only checks that someone is logged in passed every tool in that test, because the rule exists and RLS is on. A second account finds it:

Test your Supabase RLS has the three curl requests, and Supabase RLS mistakes has the fixes.

Pick by situation

Where Leakcade fits, and where it doesn't

Leakcade is a repo scan, so it's useful when the risk sits in code or history:

• You edit a Lovable or Bolt project in Cursor or Claude Code, so code arrives from more than one tool.
• You ever pasted a key into a file, even if you deleted it later.
• You want one report with file and line and a fix prompt per finding that you can paste into your AI tool.

It's the wrong pick when:

• you need the live database or dashboard settings checked. Use the Security Advisor.
• you need headers, exposed files or the deployed bundle checked. We never load your site.
• your repo is private, or you want the full history. We read public repos and the last 50 commits.
• you want monitoring. We do one-off reports, and we're new, with no track record yet.

Prompt: what did my scanners miss?

Paste this into Cursor, Claude Code or your builder's chat after the scans. It asks for the gaps the tools above can't see.

I ran these security scans on this app: [list them]. Using the code in
this repo, list what those scans could not see:
1) every Supabase policy that only checks for a login instead of the row
   owner (auth.uid() = owner column), for select, update and delete
2) every Edge Function, API route and server action that changes data
   without checking who is calling
3) every key or secret that ever appeared in code or git history
4) settings that live outside the repo (dashboard policies, buckets,
   headers) that I must check on the live project
Give file and line for each, and the smallest fix first.

Sources

1. Lovable docs: Security overview (checked Oct 31, 2026)
2. Bolt support: Check your project's security (checked Oct 31, 2026)
3. Supabase docs: Advisors (checked Oct 31, 2026)
4. GitHub Docs: Secret scanning (checked Oct 31, 2026)
5. gitleaks on GitHub (checked Oct 31, 2026)
6. Semgrep docs: Quickstart (checked Oct 31, 2026)
7. ZAP docs: Baseline scan (checked Oct 31, 2026)
8. Aikido pricing (checked Oct 31, 2026)
9. CheckVibe pricing (checked Oct 31, 2026)
10. Vibe App Scanner pricing (checked Oct 31, 2026)
11. SniffPup pricing (checked Oct 31, 2026)
12. BuildWithThis: security check of 6 scanners, tested Oct 16, 2026 (read Oct 31, 2026)

FAQ