Free security checks for vibe-coded apps compared (October 2026)
The best free routine combines three kinds of check. First, your platform's own checks: Lovable's Quick and Deep scans and Supabase's Security Advisor read your project from the inside. Second, one free outside URL scanner, such as ScanVibe, Vibeproof, PreflightVibe, bleek or AmIHackable, to see what your live app shows a stranger. Third, Mozilla's HTTP Observatory for security headers. No free check logs in as two different users, so finish with a two-account test yourself.
We make Milo's Launch Check, so read this with that in mind. Every fact about another tool comes from that tool's own website or docs, checked on 21 October 2026, and each one is linked below. We haven't benchmarked how accurate any scanner is. Free tiers change often, so check each site before relying on a detail. Corrections are welcome: hello@milokits.com.
The short table
| Check | How it looks | What the free version covers (per its own site) | Paid upgrade (per its own site) |
|---|---|---|---|
| Lovable Quick and Deep scans | Inside your Lovable project | Quick scan runs on publish: database access rules, npm dependencies, exposed MCP servers. Deep scan (run it yourself) also reviews your app code: access control, open endpoints, injection, secrets, payments, auth | Built into Lovable. Lovable says the scans don't replace a thorough security review |
| Supabase Security Advisor | Inside your Supabase project (Studio, CLI supabase db advisors, MCP) | Database lints such as tables without RLS (rls_disabled_in_public), views that bypass RLS, USING (true) policies, listable public buckets, callable security definer functions | Part of the Supabase dashboard |
| Mozilla HTTP Observatory | Outside, headers only | CSP, HSTS, cookies, HTTP to HTTPS redirect, Referrer-Policy, framing. Its FAQ says it doesn't test outdated software or SQL injection, and each domain's scan history is public | None |
| ScanVibe | Outside, live URL, passive | Its FAQ says scans are free and unlimited, with score, grade, all checks and fix instructions. Lists SSL, headers, exposed keys, vulnerable libraries, exposed files, Supabase RLS, Firebase rules and API endpoint auth | Pro $9/mo: monitoring, badges, history |
| Vibeproof | Outside, live URL or public GitHub repo, read-only | Free instant scan, no signup: headers, exposed files, leaked keys it checks are live, Supabase RLS and Firebase rules probing, library CVEs, SPF/DMARC, fix prompts | Deep scan $39 per scan |
| PreflightVibe | Outside, live URL (optional public repo or ZIP for secrets) | Free quick scan: A–F grade, counts by severity, every biggest risk and the top finding in full | Full report $29 once; weekly re-scans $12/mo |
| bleek | Outside, live URL, read-only | Its FAQ says the first scan is free: security headers, exposed secrets, TLS and exposed files | Deep Scan $19 once; human audit |
| AmIHackable | Outside, live URL, read-only | Free scan; free account for the full report. Ten areas, each marked checked, problem or not checked. Database-rule tests only after you verify the domain with DNS | Its FAQ says scan and report stay free; paid monitoring planned |
| Milo Kits instant check and free mini-check | Outside, live URL, passive | Instant: HTTPS, redirect, HSTS and main security headers on your homepage, on screen. Mini-check: automated, top 3 findings by email within 24 hours, each with a fix prompt | Person-reviewed Launch Check from $29 one-off |
What free checks can't tell you
- Whether user B can read user A's data. Most free scans run logged out. Some, like PreflightVibe, say so on their page. Do the two-account test yourself.
- Payment logic. Whether paid features unlock from a signed webhook or just from a "success" page needs someone to look at the flow.
- Server code they can't see. Outside scanners only see what the browser downloads. Lovable's Deep scan and repo scanners see code, but not what actually shipped.
A free 30-minute routine before launch
- Inside: run Lovable's Deep scan (or your platform's equivalent) and clear every Supabase Security Advisor ERROR. Start with "Table publicly accessible".
- Outside: run one free URL scanner from the table on your live URL and fix anything critical.
- Headers: run Mozilla's HTTP Observatory or our instant check, then copy a config from the headers guide.
- Two users: sign in as two test accounts and try to open each other's data.
- Re-run the outside scan after your AI coder makes the fixes. Our security prompt library has a prompt for each fix.
When to pay for something
If you take payments or store personal data, a free scan is a start, not the finish. Options range from automated scanner subscriptions to human code reviews and professional pentests. Our paid comparison and pentest comparison say when each one is the better choice, including when it isn't us.
FAQ
What is the best free security scanner for a vibe-coded app?
There isn't one that covers everything. Platform checks such as Lovable's scans and Supabase's Security Advisor see your project settings and code. Outside URL scanners see what your live app sends to a stranger. Use one of each, then do a two-account test yourself, because no free scanner signs in as two different users.
Are free URL scanners safe to run on my live app?
The scanners in this table describe their free scans as read-only: they load pages and public files and don't submit forms or run attacks. Check each tool's own description before you scan, and only scan apps you own or have permission to test.
Do I still need Lovable's scan if I use an outside scanner?
Yes. Lovable's scans read your project from the inside, including database rules and, in the Deep scan, your code. An outside scanner only sees what the live site sends to a browser. They find different things.
Does a good free score mean my app is secure?
No. A clean score means nothing showed up in the areas that tool checked. Logged-in access between users, payment logic and server code are usually not checked by free scans.
Is Milo Kits' free check one of these scanners?
Partly. The instant header check is an on-screen check of HTTPS and security headers on your homepage. The free mini-check is automated and emails your top 3 findings within 24 hours. Paid Launch Checks are a person-reviewed report, not a scanner subscription.
Sources
- Lovable docs: Security overview (Quick and Deep scans)
- Supabase docs: Advisors (Security Advisor lints)
- MDN: HTTP Observatory FAQ
- ScanVibe homepage and FAQ
- Vibeproof homepage and pricing
- PreflightVibe homepage, pricing and limits
- bleek homepage and FAQ
- AmIHackable homepage and FAQ
This page is general information, not a security audit. Only test apps you own or have permission to test. Platforms and prices change, so check the linked sources for current details. Spotted something out of date? Email hello@milokits.com.