Free security scanners for vibe-coded apps compared
What six free scanners for AI-built apps actually check, whether they need your URL, your repo or your Supabase project, and whether they verify you own what you scan. Built from each tool's own site.
Updated 2026-10-16
There are several free scanners for apps built with AI tools, and they mostly check different things: some test your live URL from the outside, one scans a public GitHub repo for keys, one grades your HTTP security headers, and Supabase’s Security Advisor reads your database settings from inside your project. The table below sets out what each one checks, what it needs from you and whether it verifies that you own what you’re scanning, using only what each tool says on its own website.
Information checked on 16 October 2026. Tools change their features and plans often, so follow the source links before relying on any detail. We make SealMyApp, which is included with the same kind of description and its limits.
At a glance
| Tool | What it checks (per its site) | What it needs | Verifies ownership? | Free tier (per its site) |
|---|---|---|---|---|
| SealMyApp | Supabase tables and storage readable with the public key; Supabase service_role key in frontend JS; open Firebase reads; secret API keys in the JS bundle; exposed .env, .git, dumps and source maps; admin/API routes answering without login; security headers and CORS | Your live URL | Yes: a meta tag, a file at /sealmyapp-verify.txt or a DNS TXT record before any scan | Score, issue counts and the most serious issue in full. All issues and fix prompts are paid (£29 Fix Pack) |
| RowShield | Free URL check: tables readable with the anon key, and a service_role key in the client bundle. Connected audit: nine Supabase rules including RLS off, tables with no policies, always-true policies, INSERT without WITH CHECK, unindexed policy columns, public buckets and key exposure | Deployed app URL (anon key optional); a connected Supabase project for the audit | Asks you to tick “I own this app or have permission to test it”; no further verification described | URL check with no account, plus one connected project with daily audits and email alerts |
| VibeProof | Security (security headers, API keys and secrets, exposed files, SSL) alongside SEO and UX issues, with AI fix prompts | Your site’s URL | Not described on its site | Its site says free scans show the score only, with a daily limit; fix prompts and full reports are on paid plans |
| VibeLocked secret leak scanner | Secret keys and tokens (OpenAI, Anthropic, Stripe, Supabase, AWS, GitHub and others), private key blocks and database URLs with passwords in a repo’s current branch (up to 150 files) | A public GitHub repo URL; no login or token | Not described; works on any public repo | Free; runs in your browser and, per its site, uploads nothing to VibeLocked |
| Mozilla HTTP Observatory | HTTP security headers and related settings: CSP, HSTS, cookies, HTTP→HTTPS redirection, Referrer-Policy, framing protection and more. Does not test code, SQL injection or outdated software | A hostname | No: its FAQ says anyone can scan any domain, and each domain’s scan history is public | No account needed; no paid tier mentioned |
| Supabase Security Advisor | Database lints such as RLS disabled in public, policies on tables with RLS off, RLS on with no policies, security definer views, permissive RLS policies, sensitive columns exposed and public buckets that allow listing | Access to your Supabase project (dashboard, CLI supabase db advisors or API) | Inherent: it only runs inside a project you can sign in to | Part of the Supabase dashboard; the docs page doesn’t mention a separate price |
How they differ
Outside-in URL scanners: SealMyApp, RowShield’s URL check, VibeProof
These look at your live app the way a stranger would. They can catch a key shipped in your JavaScript or a table your public key can read, without access to your code. They can’t see anything behind a login, and they can’t read your policies directly, only their effect.
- SealMyApp covers Supabase, Firebase, leaked keys, exposed files, open routes and headers, and requires ownership verification first. Its checks are read-only (GET and HEAD only); to prove a table is readable it fetches at most one row, keeps only the table and column names, and discards the row. It doesn’t sign in, so it can’t see one user reading another user’s data. The free scan shows one issue in full; the rest are in the paid Fix Pack.
- RowShield focuses on Supabase. Its free URL check covers the anon-key and
service_roleexposure paths, and its site says that check “does not establish that every row-level security policy is correct”; the connected audit goes further into policy quality. - VibeProof combines security with SEO and UX checks in one scan, which suits you if you want one report on all three.
Repo scanner: VibeLocked
Reads a public GitHub repo and flags secret-looking strings. It finds keys committed to code even if they never reached the live bundle. Its site notes the limits: current branch only, not commit history, and pattern matching can miss keys or flag test values. For private repos and full history it points to tools such as Gitleaks and TruffleHog.
Header grader: Mozilla HTTP Observatory
A long-standing, focused check of HTTP response headers with a letter grade. Useful for the “browser hardening” part of a checklist; its own FAQ is clear that a good grade doesn’t mean a site is secure.
Inside the database: Supabase Security Advisor
Reads your actual schema, so it sees things no outside scanner can, such as a view that bypasses RLS or a table with RLS on and no policies. Supabase’s docs note some findings may be intentional, so review each one. If you use Supabase, run it; it’s already in your dashboard under Advisors.
Which to use
- On Supabase: Security Advisor (inside) plus one outside-in URL scan, and our free RLS audit SQL. Then fix what they find with the RLS policy examples.
- Code on GitHub: a repo secret scan, plus a URL scan to catch keys added at build time.
- Before launch, any stack: an outside-in scan and HTTP Observatory, then work through the vibe coding security checklist for the parts no scanner can see.
- Your builder’s own tools are worth running too: Lovable, Bolt and Replit document built-in security scans. See security by builder.
Sources
All checked 16 October 2026.
- SealMyApp: sealmyapp.com and about
- RowShield: rowshield.dev
- VibeProof: vibeproof.dev
- VibeLocked secret leak scanner: vibelocked.com/scan
- Mozilla HTTP Observatory: HTTP Observatory FAQ
- Supabase Security Advisor: Supabase database advisors docs
We also looked for tools called Check My Vibe, VibeAudit and CodeCordon, but couldn’t find an official site describing a free scanner under those names that we could cite, so they’re not in the table.
FAQ
Which free scanner is best?
It depends on what you need checked. They look at different things: some test your live app from outside, one reads a public GitHub repo, one checks only HTTP headers, and Supabase's Security Advisor reads your database settings from inside. Running two or three that cover different areas tells you more than any single one.
Is SealMyApp included fairly?
We've described it the same way as the others: what it checks, what it needs and its limits. We make it, so weigh that. Everything said about the other tools comes from their own websites, linked in the sources list, as of the date on this page.
Why does ownership verification matter?
Scanners that test a live URL send requests to that app. Asking you to prove you control the domain (with a meta tag, a file or a DNS record) means the tool can't easily be pointed at someone else's app. Tools that only read public information, such as headers or a public repo, have less reason to verify.
Does a clean result mean my app is safe?
No. Every tool here says, in one form or another, that a clean result isn't proof of security. Automated checks can't see most logic bugs, such as one user reading another's data through your own API.
A tool I use isn't listed. Why?
We only included tools whose own websites describe what they check, so we could cite them. We'll add others when we can do the same. Email us if you'd like one considered.
Try ours for free
SealMyApp’s free scan runs after you verify you own the app, shows your score and your most serious issue in full, and keeps none of your users’ data. Run a free scan, or use the free key checker and RLS audit SQL without signing up.
Sealed — a short weekly security note for vibe coders
One common security mistake in AI-built apps, how to fix it in your builder, and one useful tool. No spam; unsubscribe any time.