Security Scanners for Vibe-Coded Apps, Compared (October 2026)
A year ago there was almost nothing built for apps made with Lovable, Bolt, v0 or Cursor. Now there are several, and their homepages all sound alike. This is a dated table of seven, built only from each vendor's own site, including where ShipWatch does less.
Short answer: All seven read a live URL and look for leaked keys. Most also test Supabase tables, look for source maps or scan a GitHub repo; ShipWatch does none of those three. ShipWatch's edge is a no-signup scan of your HTML plus 25 scripts and weekly dashboard monitoring for $19/mo.
Last checked October 20, 2026. Each cell comes from that vendor's own site on that date. Corrections welcome at support@williamtstephens.com.
What these tools have in common
Every tool here reads your deployed app the way a browser does, looks for secret keys in the JavaScript, checks for exposed files and headers, and gives you a prompt to paste back into your AI builder. None of them logs in as a user, so none can tell you whether one signed-in customer can read another's orders. Treat any of them as a fast first pass, not an audit.
The table
"Yes" means the vendor's site says so. A dash means its site didn't mention it.
| Tool | Input | Supabase table test | Source maps | Monitoring | Price |
|---|---|---|---|---|---|
| ShipWatch | URL | No | No | Weekly, dashboard | Free scan; $19 or $49/mo |
| LeakPatrol | URL | After site verification | Yes | - | Free scan (£0) |
| Lockpick | URL, repo, skill, MCP server | Deep plan | - | Weekly auto-checks | Free 5 scans/mo; Deep $19/mo |
| FixMyVibe | URL or public repo | Free scan; Pro live check | Yes | - | Free; €19, €39, €49 one-time |
| Afterprompt | URL; GitHub Action | Code + Backend, after verification | Yes | Weekly, up to 5 sites | Free; $19, $49/mo; $15 audit |
| FixVibe | URL; repo on Pro | Free passive scan | Yes | Scheduled re-scans on Pro | Free 3 scans/mo; $19, $49, $149/mo |
| Vibeproof | URL or public repo | Free scan | Yes | - | Free; $39 per deep scan |
Notes on each tool
ShipWatch
Our tool, so read this one skeptically. The scan reads your HTML plus up to 25 scripts for Stripe, OpenAI, Anthropic, AWS and Google keys and Supabase service_role or sb_secret_ keys, requests /.env and /.git/HEAD, and checks CSP, HSTS, X-Frame-Options, nosniff and HTTPS. Solo is $19/mo ($190/yr), Pro $49/mo ($490/yr), both with weekly monitoring shown on the dashboard. It doesn't send alert emails today.
LeakPatrol
A to F grade in about a minute. Lists GitHub keys, n8n, Make and Zapier webhook links, source maps and, once you verify the site, a readable-tables test. Details in ShipWatch vs LeakPatrol.
Lockpick
Pulse covers the homepage, SPF and DMARC, headers, TLS, and DNS, certificate and subdomain records. Repo, skill and MCP server checks are free on every plan. Deep adds Supabase, Firebase and Convex rules. See ShipWatch vs Lockpick.
FixMyVibe
Repo mode is the draw: Stripe webhook handlers that skip signature checks, USING (true) policies in migrations, and dependency CVEs. Reports arrive by email, usually within about an hour. Paid tiers are one-time, not subscriptions.
Afterprompt
Free scan covers keys, source maps, private files, headers, HTTPS, cookies, CORS, and SPF, DMARC and DKIM. Code ($19/mo) runs on every push; Code + Backend ($49/mo) tests Supabase and Firebase rules on sites you own and monitors up to 5 sites weekly.
FixVibe
Passive scans cover headers, secrets, Supabase and Firebase exposure, source maps and DNS. Active probes need a verified domain and a paid plan. Paid plans include MCP and API access and outbound webhooks.
Vibeproof
Free scan of a URL or public repo in about 15 seconds, with live verification of leaked keys, Supabase RLS and Firebase probing, and SPF and DMARC. The $39 deep scan adds Nuclei, testssl.sh and Nikto.
How to pick
- Supabase app: pick a tool that tests tables, or run the curl in our RLS checklist. ShipWatch won't do it for you.
- Code on GitHub: a repo scan sees webhook handlers and migrations that no URL scan can.
- Shipping weekly: a tool that re-checks beats a one-off scan of an app that keeps changing.
Keep watching weekly with ShipWatch: Solo $19/mo or Pro $49/mo, results on your dashboard. Compare plans.
What the free scan checks here (and what it doesn't)
ShipWatch checks secret key patterns in your HTML and up to 25 scripts, Supabase service_role and sb_secret_ keys, /.env, /.git/HEAD, CSP, HSTS, X-Frame-Options, nosniff and HTTPS. It does not test Supabase tables, does not look for source maps or webhooks, and does not scan repos, MCP servers, or DNS, email and certificate records.
FAQ
- Which scanners test whether my Supabase tables are readable?
- Per their own sites: LeakPatrol and Afterprompt after site verification, Lockpick on Deep, FixMyVibe in its free scan and Pro live check, and FixVibe and Vibeproof in their free passive scans. ShipWatch doesn't test tables.
- Which ones can scan a GitHub repo?
- Lockpick, FixMyVibe and Vibeproof accept a public repo; FixVibe repo scans need Pro; Afterprompt's Code plan uses a GitHub Action. LeakPatrol and ShipWatch scan live URLs only.
- How was this table made?
- Every cell comes from the vendor's own website on October 20, 2026. Anything we couldn't confirm there is left blank or out. Vendors can send corrections to support@williamtstephens.com.