Vibe coding security scanners compared, including ours

You typed "best vibe coding security scanner" into a search box, and the first comparison that came back was written by one of the scanners. The disclosure was there, in a line under the table.

Reeve is one of the ten tools below, so this page has the same problem. Reeve is a free security scanner that reads a live URL in about twenty seconds with no account, and a paid subscription that keeps watching the app afterwards and keeps a verified copy of its database. What we can do about the conflict is show the working. Every row was read off each tool's own site on 7 September 2026, every price is printed including ours, nothing here is a paid placement, and there is a section near the end naming the three jobs on this page Reeve does not do at all.

Here is what the vendor comparisons leave out. Most of these tools read the same surface. They load your live app, pull down the JavaScript it ships to a browser, read the headers that came with it, ask your database a question any stranger could ask, and write down what answered. The scan is the part they have in common. Three questions separate them:

1. Can it tell a key that belongs in your app from one that does not?
2. Does it say so when a check got no answer?
3. Does anything happen on the day your data is actually gone?

Which vibe coding security scanner is best?

The one that can read the surface your problem is on. That question sorts this list faster than any feature list will, and it splits ten tools into three groups.

Tools you hand a URL. SafeToShip, LaunchGuard, Vibe App Scanner, VibeEval, SupaExplorer and Reeve. You paste an address, they load your app the way a visitor would, and a report comes back inside a minute or two. Nothing to install, no account to connect, no access to anything you own.

Tools you hand your code. CheckVibe reads a live URL and will also connect to a GitHub repository if you let it. Reading source answers questions a URL scan cannot ask, and it carries a blind spot of its own, which is why what a URL scan misses is worth reading before you pay for either kind.

Tools you hand your Supabase account. Supabase's own Security Advisor sits in your dashboard and reads the project's configuration. Defencecore asks for read-only access to one project's logs and then watches them. Supabomb is an open-source command line tool written for people who do this professionally. All three reach things from inside the account that nothing standing outside your app can see.

If you are on Supabase and have never opened the Security Advisor, open that before you pay anybody on this page. It is free, it runs on its own, and it emails the project owner when a table shows up with row level security switched off. It is also not a competitor to anything here: it reads your configuration, where a scan reads what your configuration is doing to strangers, and those two come apart more often than anyone expects.

What does each scanner actually read?

Seven of the ten will run on nothing but a URL. The other three want something you have to log in to hand over, and that is the column to read before any feature list. The two on the right are the ones that decide whether you can try a tool this morning: five will scan for you with no account at all, and four of those five show you the whole report.

Every row was read off each tool's own pages on 7 September 2026. This is a young category and the pages move, so treat the row as older than the site it came from.

That table is where most comparisons stop, and it is the part that separates these tools least.

The three questions, tool by tool

Reeve is the only one of the ten that answers yes to all three.

"Its page does not say" is what it says. We can read what these tools publish about themselves; we cannot see the report yours would get. The three sections below explain each column and give you a way to test it on your own app, by scanning it with two of these tools and reading the two reports side by side.

Can it tell your safe keys from your dangerous ones?

Reeve can, by decoding the key and reading the role written inside it. That single capability is the difference between a report you can act on and a list of forty things you learn to scroll past.

Start with why the counts differ so much. A check count is a marketing number rather than a measurement: CheckVibe advertises over a hundred, Reeve runs nine and publishes how often each of the nine ever fires across 30,998 apps. A longer list about the same app is a longer list. The bigger cause is that some scanners treat every key they find in your JavaScript as a problem, and some of those keys are supposed to be there.

Your Supabase publishable key belongs in your frontend. So does a Stripe key beginning pk_live_. Both travel to every visitor by design, because the request they identify is made from the visitor's browser, and neither one grants anything on its own. Which keys are safe in your frontend is the whole of that distinction.

On 7 September 2026, VibeEval's homepage listed "Stripe pk_live_ found in /assets/app.js" among five example findings, marked CRIT. That is a publishable key, sitting in the place Stripe publishes it to. We cannot see the reports any of these tools send their real customers, so read that as one marketing page rather than as a verdict on the product. It is a clean example of the thing to test for, and the damage is not the one wrong line. A scanner that hands you a critical finding for having done something right teaches you to shrug at the next one, and the next one is the real finding.

An older Supabase key is a JWT, and its middle section states "role": "anon" or "role": "service_role" in readable text. Reeve reads that word. A publishable key in your bundle comes back under a heading saying you got this right, costing you nothing, and a service_role key in the same bundle is the worst thing the scanner knows how to find. Those two look nearly identical in the Supabase dashboard, sitting next to each other, which is how the wrong one ends up copied.

Does it say so when a check got no answer?

Reeve does, in those words. A check ends three ways and only one of them is a pass: it finds something, it gets a clear no, or it gets nothing at all because the request timed out, the host refused it, or the page never finished loading. That third ending is the empty slot on the right of the picture above. It prints as "Couldn't check" and it leaves your grade alone.

This is the quietest thing on the page and the one that decides whether a report is worth anything, because a probe that got no answer looks exactly like a probe that came back clean once somebody has rounded it up to a tick. You would act on that tick. There is nothing behind it.

We went looking for the same promise on the other nine sites on 7 September 2026 and did not find it made anywhere. That is not evidence that any of them round up. It is a claim none of them puts in writing, and it is the one we would want in writing before believing a green report about an app we cared about.

The same rule governs the numbers Reeve publishes about everyone else. Between 12 and 14 August 2026 we ran all nine checks over 30,998 live vibe-coded apps built on Lovable, Bolt, v0, Cursor, Replit, Windsurf and Base44, released every aggregate under CC BY 4.0 so anyone can reuse it, and wrote down how often each check fired, what share of apps it could not reach, and how those were counted. A check that got no answer sits in its own column rather than in the clean pile, so nothing on that page is inflated by counting silence as safety. LaunchGuard's homepage publishes 96 apps tested and 2.37 million exposed records. None of the other eight sites we read published a figure at all.

What happens on the day your data is gone?

Nothing, on nine of the ten. A scanner finds the open door. It cannot tell you who already walked through it, and it cannot return a table somebody emptied on Tuesday.

Reeve Care is the tenth, and closing that gap is why this company exists. It takes copies of your Supabase database on a schedule, opens each copy and counts it against what went in before the copy counts as a backup, holds them outside your Supabase account so a suspended project or a login you cannot recover leaves them where they are, and replaces your data from one when you ask. A copy of the current state is taken first, before anything is replaced.

Your uploaded files travel with the rows once you connect a Storage credential, which is a second key asked for separately and the only one Reeve holds that can write, because Supabase issues no read-only key for files. What that actually does is drawn out on the backups page.

Supabase is the only thing Care can back up, so if your data lives in Firebase or somewhere else, this whole section is not available to you and the scanning half is what Reeve has to offer. Vibe App Scanner and SafeToShip both check Firebase security rules, which is the nearest equivalent on this page.

What do you get for a monthly subscription?

On nine of the ten, more scans. On Reeve, the scans plus what happens after one of them finds something.

Those competing figures are what the five sellers publishing one were showing on 7 September 2026: SafeToShip $24, Vibe App Scanner $29 or $49, VibeEval $49 with a $149 team tier, Defencecore $29, and SupaExplorer lower at $6.75 behind a discount banner. CheckVibe and LaunchGuard publish no figure at all. Read the current price on the seller's own page before you buy anything, and that includes ours, which is sometimes below the list figure here and never above it.

Every paid plan here can be tried before it charges you. Reeve gives you seven days, Defencecore seven, and VibeEval advertises fourteen with no card. The others do not say on their pricing pages.

Two things fall out of that last row. Reeve Monitor is $12 a month for three apps, below every paid tier here except a discounted one, and it is the whole watching half: hourly re-scans, a 60-second uptime probe, alerts when something changes, and a monthly report. And Reeve Care is $49 a month, which is exactly what VibeEval Pro and Vibe App Scanner Pro charge, while being the only subscription on the page that also holds a verified copy of your database and puts it back on request. Above that, Care Pro at $79 adds five apps, backups twice a day and a public status page, and Care Max at $139 takes them four times a day and sits under VibeEval's $149 team tier.

Where Reeve is not the answer

Three jobs on this page that Reeve does not do at all.

• Reading your source code. CheckVibe will if you connect GitHub, and the dedicated secret scanners built for that job go deeper than either of us. It is also the only way to find a key that left your app months ago and is still sitting in its history.
• Testing the app while signed in. VibeEval drives a real browser through login screens, Vibe App Scanner runs authenticated scans on its top plan, and LaunchGuard's paid tier drives Claude Code through authorisation scenarios. Reeve never signs in, never writes and never downloads a row, which is what makes it safe to point at a production app with real customers on it, and which is also why a bug that only shows itself to a signed-in user is invisible to it.
• Being open, or being driven by your agent. Supabomb is open source and written in Python. Vibe App Scanner publishes an MCP server, CheckVibe pulls its findings into Claude or Cursor, and Supabase's advisor is reachable through Supabase's own MCP server. Reeve publishes neither its source nor an MCP server.

Where Reeve is the answer: your app is live, you want to know what it hands strangers right now without connecting an account to anything, you want a report that tells you what you got right as clearly as what is open, and you would like somebody to be holding a verified copy of your database on the day it goes wrong.

What are you handing over when a tool reads your code?

Standing access to everything in the repository, which is a much larger thing than the app.

Your repository is not your app. It holds every key you ever committed and later took out, the seed and fixture files with real-looking customer data in them, the half-finished branch nobody deployed, and the instructions you wrote for your AI builder. That last one surprises people. Your CLAUDE.md, your .cursorrules, your AGENTS.md, the long prompt describing how the product is meant to behave: that is your design thinking, in plain text, in the repository. A URL scan sees the app your visitors see. A repository connection sees all of it, and a second company now holds a copy.

Three things to check before you grant one:

• It is standing access, not a visit. A GitHub App or an OAuth grant keeps working until you go and revoke it, so it reads what you push next month too. Find out whether you can scope it to one repository, and find the revoke button before you need it.
• Their breach becomes your breach. Whatever a vendor holds about you is exposed when the vendor is. Defencecore argues exactly this for itself on its own page, and the argument is a good one: a tool that only reads can "never become the incident".
• A tool that signs in can change things. A scanner driving a browser through your login is doing what a user does, on your live data. Read what it says it will and will not click.

This is a trade rather than a warning. A repository scanner finds the key you deleted in April and nothing reading your live site ever will, so if that is the question you have, the access is what it costs to answer it.

Which one should you pick?

Five situations, and two of them do not end with us.

• You want to know what your app shows strangers, right now, for free.Reeve's scan or LaunchGuard. Neither asks you to sign up, and both come back inside a minute. SafeToShip and SupaExplorer will also scan with no account.
• You are on Supabase and have never opened the Security Advisor. That first, before anything on this page with a price on it. It is free and it reads what no outside scan can.
• You want your source code read, or the app tested while signed in. CheckVibe for the repository, VibeEval or Vibe App Scanner's top plan for behind the login. Read the section above on what that access costs before you grant it.
• You want the app watched and you are counting pennies. Reeve Monitor, $12 a month for three apps: hourly re-scans, a 60-second uptime probe, alerts and a monthly report, and no backups at all.
• You have real customers, and nobody who will be running a restore under pressure. Reeve Care, $49 a month, which is the scanning and the watching and a verified copy of your database that goes back with one button. If your data is not in Supabase, the backup half does not apply to you.

What to do this week

Reeve's free security scan reads a live URL in about twenty seconds with no account, grades what it found, and lists the things you got right beside the things that are open. Watching an app afterwards starts at $12 a month, and backups with one-button restore at $49; the plans are here. If you would rather go through your app yourself first, the 10-minute security checklist is the same ground without a tool in the way.