Scanners aimed at vibe-coded apps
These products describe themselves as checks for apps built with AI coding tools. Prices are copied from each product's own page on 2026-10-14. Where two of a vendor's pages disagree, the cell says so.
Last updated
| Tool | Price | What it catches | Who it suits |
|---|---|---|---|
| Aikido | Developer plan at $0, free forever, for 2 users. The pricing page was last recorded here on 2026-10-13. | SAST, dependencies, secrets, and cloud checks are on the free feature list. DAST is also listed there. | A team that wants one hosted product rather than a URL-only scan. |
| AmIHackable | $0. The pricing page says the scan and the full report are free, and that future monitoring prices are not set. | A public site: keys in JavaScript, exposed user data, and Supabase table checks that the page says still run before domain verification. | A first look at a URL you can share, while the product is being rebuilt. |
| Lovable Security Scan | No separate price on Lovable's security page. A basic scan runs on every publish. Recurring deep scans are described for Business and Enterprise. | Database configuration, RLS policies, and cloud project settings on the basic scan. The deep scan analyzes the codebase. | An app you are publishing from Lovable. It does not scan an unrelated URL. |
| SafeToShip | Headline: free scan, full report $9, unlimited $24/month. The FAQ says a free account gets 1 scan per month. | Ten modules on a live URL, including headers, leaked API keys in JavaScript, and Supabase RLS. | Someone who wants a URL grade and is willing to read the pricing FAQ before paying. |
| Snyk | Free plan at $0 per month. The plans page was last recorded here on 2026-10-13. A numeric free-plan test limit was not on that page. | SCA, SAST, infrastructure-as-code, and containers on the free plan. It does not check Supabase RLS. | Dependencies and code in a repo, not a pasted production URL. |
| Vibe App Scanner | The site root lists Go at $29/month and Pro at $49/month. /pricing lists Go at $19/month and Pro at $39/month. Both say the first scan is free. | A deployed URL: secrets in JavaScript, missing Supabase RLS, Firebase rules, weak passwords, and missing headers. | A live app, after you decide which of the two price pages you are looking at. |
| vibecheck (themeridianlab.com) | Free at $0 for unlimited single-URL inspections. Pro $29/month and Team $99/month are listed, and the page says they launch when the GitHub App is ready. | A deployed URL, including Supabase keys and row level security. The free tier's detector count is printed as both 15 and 23 on the pricing page. | A URL you are allowed to inspect, without uploading the repository. |
Sources
Each cell is a shorter restatement of that tool's page on this site. The tool page lists the public URL that was checked and anything still unknown.
- Aikido, checked 2026-10-13. www.aikido.dev/pricing, www.aikido.dev/
- AmIHackable, checked 2026-10-14. amihackable.dev/pricing
- Lovable Security Scan, checked 2026-10-14. lovable.dev/security, docs.lovable.dev/integrations/supabase
- SafeToShip, checked 2026-10-14. safetoship.dev/pricing, safetoship.dev/
- Snyk, checked 2026-10-13. snyk.io/plans/
- Vibe App Scanner, checked 2026-10-14. vibeappscanner.com, vibeappscanner.com/pricing
- vibecheck (themeridianlab.com), checked 2026-10-14. vibecheck.themeridianlab.com/, vibecheck.themeridianlab.com/pricing