Security tools for vibe-coded apps

One dashboard for dependency, code, secret, and cloud findings when you do not want to assemble separate scanners.

Scanning dependencies, code, containers, and infrastructure-as-code from an IDE, CLI, or git host, with a free plan for individuals and small teams.

Finding insecure patterns in a repository's code with CodeQL, especially on a public GitHub repo.

Pattern-based code scanning you can run locally or connect to GitHub, with a free cloud tier for small teams.

Catching Supabase-specific mistakes such as public tables with row level security disabled.

Alerts and pull requests when a dependency you already use has a known vulnerability.

A local look at known vulnerabilities in the packages already installed in a JavaScript project.

Catching malicious or surprising dependency behavior, not only packages that already have a CVE.

Exercising a running site you are allowed to test, with a proxy aimed at people who are new to security testing.

Forwarding Stripe webhook events to a local server so you can test signature verification.

Finding known credential patterns that were committed to a GitHub repository, and blocking some pushes before they land.

Searching a git history for secrets from your own machine or from CI.

A quick public report on what a URL loads and whether Cloudflare had a malicious-content verdict.