Running-app and database checks

These look at a running URL or a Supabase project rather than only at source code. Point them only at systems you are allowed to test.

Last updated Oct 13, 2026

Scanner comparison. Rows are alphabetical, not ranked.
Tool	Price	What it catches	Who it suits
Cloudflare Radar URL Scanner	Free on the Free / Radar plan: 5,000 public scans a month and no unlisted scans, at 1 scan per 10 seconds. Unlisted scans require a dashboard login.	What a URL loads, plus a malicious-content verdict when Cloudflare has one. It does not sign in as a user or test row level security.	A quick outside look at a deployed URL. Do not submit a URL that has a secret in the query string.
OWASP ZAP	The homepage on 2026-10-13 did not state a price or a license.	Issues in a running site exercised through a testing proxy. The homepage does not list the default checks.	Someone new to security testing who will only scan an app they own. It is a poor first step before checking keys and database rules.
Supabase Security Advisor	The advisor docs do not list a separate price. Whether every Supabase plan includes it was not stated.	Supabase project issues such as public tables with row level security disabled. A secret key still bypasses those policies.	A Supabase project, checked in Studio or with `supabase db advisors`, before the URL is shared.

Sources

Each cell is a shorter restatement of that tool's page on this site. The tool page lists the public URL that was checked and anything still unknown.