| Tool | Approach | Price | Free tier | Public badge |
|---|---|---|---|---|
| Broid | External scan of the live app. Database exposure, secrets, headers, TLS, cookies, CORS, dependency CVEs, AI-endpoint abuse. A–F grade. | $5 / 5 reports · $50 / 100 | Unlimited grades, no signup | Yes, with public verification page |
| VibeEval | Autonomous agents, 310+ probes, human-verified exploits. Works behind authentication, which most cannot. | $49–$149/mo · $499 lifetime · pentests from $2,900 | Limited | Not found |
| Vibe App Scanner | "Attack-grade" live scanning, 150+ checks, fixes formatted for AI editors. | $19–$39/mo | First scan free | Not found |
| SafeToShip | Quick and deep scans, plus continuous monitoring. | $9 one-time · $24/mo | Free quick scans | Yes |
| Vibe-Scan | Deployed-app scan: keys, RLS, headers, CVEs. Closest analogue to Broid. | From $9 | Not published | Not found |
| SafeVibe | Database exposure only. Narrow but free. | Free | Yes | No grade or badge |
| LaunchSafe | Credentials, headers, GDPR checks. | Not published | Not published | Not found |
| Also in the category, which we have not tested and so do not rate: CheckVibe, SimplyScan, Aikido, ZeriFlow, VibeWrench, AmIHackable, SecureVibing, VibeShip, SupaScan, SupaExplorer, Unpwned, DeploySafe. This list is not exhaustive and the category is adding tools monthly. | ||||
Before any of the above: every major AI builder now ships its own security scanner, and they are better than the category's marketing suggests. Lovable runs free Basic and Deep Scans. Bolt has scanned on publish since October 2025 and writes and applies most fixes itself. v0 has applied checks since August 2025 and blocked over 17,000 deployments for exposed secrets in one 30-day window. Replit runs deterministic Semgrep rules automatically.
They read your source code, which no external scanner can. Run yours. Then use an external tool for the thing a built-in scanner structurally cannot do — test the deployed app as a stranger meets it, and be independent of the system that wrote the code.
A comparison written by a participant is only worth reading if this section is real.
| Situation | Use |
|---|---|
| Shipping a side project this weekend | Your platform's built-in scan, then any free external grade. Spend nothing. |
| Launching to real users, no sensitive data | Built-in scan + an external scan. Broid if you want a verifiable grade for about a dollar; SafeToShip if you want monitoring from day one. |
| Handling money, health or regulated data | VibeEval or a human penetration test. No cheap automated tool is sufficient here, ours included. |
| A studio managing client sites | Something with a badge your client can verify — Broid or SafeToShip. A grade nobody can check is not evidence. |
| You only care about database exposure | SafeVibe, free. Or the manual test, which takes 60 seconds and costs nothing. |
Whichever you choose, start with a baseline. Free A–F grade in seconds, no signup, including the live database-exposure test.
Scan my app free →Worth stating because the category's marketing rarely does. No automated scanner tests business logic properly. None of them will tell you whether your refund flow can be abused, whether your pricing can be manipulated client-side, or whether your permission model makes sense. Research on agentic coding tools found them "very prone to business logic vulnerabilities" while producing almost no classic injection bugs — which is precisely the shape automated scanning is worst at.
And none of them makes you compliant with anything. A scan is evidence toward a testing process, not a certificate. We wrote up what actually applies to a small app, including the rules that don't.
It depends on budget and stakes. VibeEval is the most technically capable, running autonomous agents behind authentication, at $49–$149/month. Broid is the cheapest route to a verifiable graded result, free for unlimited grades with reports from about a dollar. SafeToShip sits between them and adds continuous monitoring. Whichever you pick, run your platform's own free built-in scan first — it reads source code that no external tool can see.
Yes, several. Broid gives unlimited A–F grades free with no signup. SafeVibe checks database exposure free. SafeToShip offers free quick scans. Vibe App Scanner gives one free scan. And every major AI builder — Lovable, Bolt, v0, Replit — ships a free built-in scanner, which is the first thing to run.
The built-in scanner reads your source code, which is genuinely valuable and no external tool can do it. What it cannot do is test your deployed app the way a stranger meets it, or be independent of the system that generated the code. Environment variables that differ between preview and production, a policy disabled while debugging, a table added after the last publish — all invisible to a code scan, all obvious from outside.
Little to nothing at first. Free tools cover a lot, and a full automated report costs about a dollar. Continuous monitoring runs $9–$40/month. A human penetration test costs $2,000–$50,000 and is the right answer only if you handle money, health data or anything regulated.
You shouldn't, entirely — which is why every price here links to the vendor's own page, why there is a section on where Broid loses, and why we say plainly that VibeEval goes deeper than we do and SafeToShip has monitoring we don't. Check the claims. If any are wrong, tell us and we'll correct them publicly.
A–F grade in seconds, no signup, including a live test of whether a stranger can read your database.
Scan my app freeAnd if a tool above suits you better, use that one. A scanned app beats an unscanned app either way.