LaunchGuard alternatives in 2026

What is the best free Supabase security scanner?

Four of the five here are free to run. The Supabase Security Advisor costs nothing and is already inside your dashboard, but it inspects your project's configuration rather than your shipped app. SecurifyAI's RLS scanner is open source and free to use, and can be run locally or as a Firefox or Chrome extension. Suparbase's Security Scanner is free with “no sign-up, no email wall, and no trial timer”, and shows “which of your tables an anonymous visitor can read right now”. BreachProbe's scan is free with no account and nothing installed. LaunchGuard also has a free tier that its pricing page states is not a findings paywall.

Which of these actually tests row-level security?

Only the ones that sign in. BreachProbe signs up two accounts and reports cross-tenant results table by table. LaunchGuard signs in as a real user and lets you save a cross-user leak as a guard it can re-run. Suparbase gets closest of the rest: its scanner is explicitly the anonymous view, but its admin can “simulate SELECT/INSERT/UPDATE/DELETE as any role with custom JWT claims. All rolled back.”, which answers the question one query at a time rather than reporting it. The Supabase Security Advisor and SecurifyAI's scanner do not publish a test of one authenticated user reading another's rows on the pages cited here. That distinction matters more than price: a policy that is enabled but wrong looks identical to a correct one from the outside, because both of them refuse an anonymous request.

Do I need to give a scanner access to my Supabase project?

Two of these ask for it. The Supabase Security Advisor runs inside the dashboard, so it needs dashboard access by construction. Suparbase asks you to “Paste a Supabase URL + API key”, which it encrypts at rest and proxies server-side so the key never reaches the browser — though its free Security Scanner needs no account. BreachProbe needs one URL and states “No account · nothing installed · read-only”. LaunchGuard scans from a URL, with sign-up (free, no card) required to see the full detail of a leaked key. SecurifyAI's scanner runs on your own machine or in your own browser, which is why it is the one to reach for when the app cannot be exposed to a third party at all.

How often should a vibe-coded app be re-scanned?

Every time you ship, because the failure mode is a new table or a changed policy rather than a new vulnerability in old code. Three of these automate it: LaunchGuard's Pro tier re-checks on every deploy automatically, Suparbase's Hosted tier runs “Agent Sentry continuous scans” as a continuous anon-key probe, and BreachProbe's $39 tier re-scans nightly for 30 days and emails on a new critical or high finding. The Supabase Security Advisor runs automatically inside the dashboard but only sees configuration. A scan you have to remember to run is a scan that stops happening in week three.

You ship every week and want the check to run itself. LaunchGuard is the only tool in this table that re-checks on every deploy automatically and keeps a history — “Memory: we remember every result and every call you made” — and at $29/month that is cheaper than buying a one-off report every month. It also covers Firebase, which BreachProbe does not.

You have not run anything yet. It is already inside the dashboard you are logged into, it runs on its own, and it sees things no external scanner can — an unindexed foreign key, a table with RLS disabled, a function with a mutable search path. Run it first, whatever else you do. It reads your project's configuration rather than your shipped app, which is why it is a different check and not a lesser one.

You want one tool that both RUNS your Supabase project and watches it, rather than a check you run at launch. Suparbase is the only option in this table that is also a working admin — prod→staging sync, a per-row audit log, inline editing, and a live RLS simulator that can “simulate SELECT/INSERT/UPDATE/DELETE as any role with custom JWT claims”. Its free tier is genuinely free forever for up to 3 connections, and at “$12 per user / month” its Agent Sentry keeps a continuous anon-key probe running, which is the cheapest standing watch here. Its five free tools — a Security Scanner, an RLS generator, a schema visualiser, a type generator and a secret scanner — also need no account at all: “no sign-up, no email wall, and no trial timer.”

You want to read the code that is testing you, or run it against something you cannot expose to a third party. It is the only option here that is open source — “This Supabase RLS scanner is open source and free to use. You can inspect the code, run it locally, and customize it” — which also makes it the only one you can point at localhost or an internal environment.