Best Security Scanners for Vibe-Coded Apps (2026): 12 Tools, Free Ones First

TL;DR: As of November 2026, 6 of the 12 security scanners below cost $0 for a two-person team, and two more come with tools you already pay for, so cost is not your excuse. If you built on Lovable, Bolt, Replit or Cursor with Supabase behind it, run three free things today: your builder's own scan, Supabase's Security Advisor, and a secret scanner like GitHub's or Gitleaks. Add Aikido or Snyk once a second developer touches the code. Every price below comes from the vendor's own pricing page, read November 3, 2026. And none of these tools reliably catches the bug that leaks the most data in vibe-coded apps. More on that below.

I've shipped 50+ products, including as CTO of an AI startup, and this site runs Brakeman (a Rails code scanner) and a JavaScript dependency audit on every push. Scanners are cheap insurance. They are not a security review. This list is about knowing which one catches what.

The 12 scanners side by side: what each catches and what it costs

Two terms you'll see everywhere: SAST reads your code without running it. DAST attacks the running app from the outside. SCA (software composition analysis) checks the open-source packages your app pulls in for known holes. Most of the paid tools bundle all three.

Free scanners to run before you pay for anything

1. Your builder's own scan. On Lovable, the Quick scan runs every time you publish. Its docs say it checks your database access rules (including tables with no row-level security, or RLS, the setting that decides which rows each user can read), known holes in your npm packages, and an MCP server your app exposes without login. The Deep scan reads your actual app code for users who can see data that isn't theirs, endpoints anyone can trigger, injection, leaked secrets, payment logic a customer can skip, and weak sign-in checks. The catch: Deep scan doesn't run on its own. You start it from the Security view or ask for it in chat. Lovable's own docs say these tools "cannot guarantee complete security."

2. Supabase Security Advisor. If your app has a Supabase backend, open your project, then Advisors, then Security Advisor. It ships with every project and runs deterministic checks, including "RLS disabled in public," "sensitive columns exposed" and "public bucket allows listing." That first one is the check that matters most. It is the setting behind CVE-2025-48757, the 2025 disclosure that found 170 of 1,645 scanned Lovable showcase apps exposing data.

3. A secret scanner. GitHub scans public repos for leaked keys for free, and its push protection blocks a commit that contains one. On private repos, Secret Protection is $19 per active committer a month. If you'd rather not pay, Gitleaks and TruffleHog are free and open source, and you can run either on an exported repo in a few minutes. TruffleHog's README says it classifies over 800 secret types and checks whether a found key still works, which tells you what to rotate first.

4. OWASP ZAP. The free, open-source DAST scanner most security people learned on. It is the most powerful free tool here and the least friendly. If nobody on your team has used a proxy before, skip it and use a vibe-specific scanner instead.

If you have no idea where to start, the free vibe coding security checklist walks through the 20 checks I'd run on any AI-built app before turning a scanner on, most of them in your browser.

Why scanners miss the bug that leaks the most data

Scanners work by matching patterns. A table with RLS switched off is a pattern. A secret key sitting in a variable your browser can read is a pattern. An npm package with a published hole is a pattern.

The leak that keeps showing up in vibe-coded apps is different. It's broken access control: the database rule is switched on, the scanner sees a policy and moves on, but the policy says "any signed-in user can read every row." Or your server code uses the Supabase secret key, which skips every RLS policy, and returns whatever ID the browser asks for. Security people call that IDOR (insecure direct object reference): change the number in the URL, see someone else's invoice.

No pattern catches that, because the code is valid. It just doesn't match what you meant. That's why Lovable's Deep scan, Aikido's AI pentests and VibeEval's engineer review all exist: they try to act like a second user. And it's why the cheapest test still works best. Sign up as two users, log in as user B, and try to open user A's records.

And the models writing your code lean the wrong way: in Veracode's 2025 test of 100+ models on 80 coding tasks, the models chose the insecure option 45 percent of the time.

Paid scanners for when a second developer joins

Semgrep. Free for up to 10 contributors and 10 repos, with cross-file analysis and 60 AI credits. Teams pricing is $30 per contributor a month for code scanning, $30 for supply chain and $15 for secrets. Its rules are readable, so a developer can see why something was flagged and write their own.

Snyk. The free plan gives you 100 code tests a month, 200 open-source tests, plus container and infrastructure scanning. Team starts at $25 a month for teams of up to 10 developers with 1,000 code tests. Snyk's AI pentesting is Enterprise only.

Aikido. The free Developer plan covers 2 users, 10 repos, 1 domain and 1 cloud account, with code, dependency and secret scanning plus a live-app scan. Basic is $350 a month including 10 users, Pro is $700 and Advanced is $1,050. Startups can apply for up to 30% off. Aikido is also the AI pentest connector inside Lovable.

Claude Code /security-review. If you already build in Claude Code, it ships a /security-review command that reviews your pending changes, and Anthropic publishes a GitHub Action that comments on pull requests using your own API key. It's an AI reviewer, so treat it like a sharp colleague, not a guarantee. My longer take on the tool is in the Claude Code review.

Wiz. Built for companies with a cloud security team, and it shows: the pricing page is a quote form with no numbers. Lovable workspaces can connect it so Wiz findings show up next to Lovable's own. If you're a founder without a security hire, you don't need Wiz yet.

Aikido vs Snyk for a two-person team

My read: for two founders and one repo, Aikido's free plan does more out of the box, mostly because it adds a live-app scan and cloud checks. The math flips when you outgrow free. Aikido's next step is $350 a month; Snyk's is $25. If your free limits run out and nobody is asking you for a pentest report yet, Snyk Team is the cheaper move. If a customer is asking for that report, Aikido gets you the scanner and the pentest from one vendor.

Scanners built for vibe-coded apps

Two newer tools aim straight at founders who don't read code. Both test your live URL, so they need no repo access.

Vibe App Scanner gives a free URL preview, then Go at $29 a month or Pro at $49 a month. It lists 150+ checks across 8 categories, including Supabase RLS testing, Firebase rules and rate limiting. To its credit, it says plainly that a URL scan can't prove every user-role permission and that "no findings is not proof of security."

VibeEval has a 14-day free trial, then Pro at $25 a month (listed down from $49), Team at $75 or a $249 lifetime plan. Its pitch is that a security engineer verifies findings before you see them, which cuts the false alarms a non-technical founder can't sort on their own.

Neither one replaces the Supabase Advisor, which reads your actual database settings instead of guessing from outside. Use them together. If you're still choosing what to build on, the security story differs a lot by tool, and the best vibe coding tools ranking covers where each builder breaks in production.

Which scanner stack fits your stage

• Solo, not launched: your builder's scan, Supabase Security Advisor, Gitleaks once. $0.
• Live with paying users: add GitHub push protection or Aikido free, plus a vibe-specific URL scan once a month. $0 to $49 a month.
• Second developer, enterprise customer asking questions: Snyk Team or Aikido Basic, and budget for a pentest. From $25 a month plus about $4,000 once.

Scanners give you a list of findings. They don't tell you which ones matter, and they don't fix the access-control logic. When the list gets long, or you want to know what a full audit costs, how much it costs to audit a vibe-coded app breaks down each tier. And if you'd rather hand the whole thing to someone, Vibe Code Rescue starts with a free repo audit.

Do this today: the 10-minute scan

Open your Supabase project, go to Advisors, then Security Advisor, and fix every error that says "RLS disabled in public." Then sign up to your own app with a second email, log in as that user, and try to open a record that belongs to your first account. If you can see it, no scanner on this list was going to tell you.

Sources

• Lovable docs, Security: Quick scan, Deep scan, auto-fix, Wiz and Aikido connectors. Read November 3, 2026.
• Supabase docs, Advisors: Security Advisor checks. Read November 3, 2026.
• GitHub Security plans: Secret Protection $19, Code Security $30 per active committer/month. Read November 3, 2026.
• TruffleHog and Gitleaks on GitHub. Read November 3, 2026.
• Anthropic, Claude Code Security Reviewer: /security-review and the GitHub Action. Read November 3, 2026.
• Semgrep pricing, Snyk plans, Aikido pricing (USD) and Wiz pricing. Read November 3, 2026.
• OWASP ZAP. Read November 3, 2026.
• Vibe App Scanner pricing and VibeEval. Read November 3, 2026.
• Matt Palmer, statement on CVE-2025-48757: 170 of 1,645 Lovable projects vulnerable. Read November 3, 2026.
• Veracode, July 30, 2025: 45 percent insecure choices across 80 tasks.