Security scanners for vibe-coded apps

What is the difference between a configuration check and an external scan?

A configuration check reads your project's own settings — the Supabase Security Advisor's published checks include "auth users exposed" and unindexed foreign keys, and it runs automatically inside the dashboard. An external scan reads what your app actually serves to the internet: the keys left in the shipped JavaScript bundle, the tables that answer with no login, and what a signed-in user can reach. They overlap very little, which is why running one is not running the other.

Why does the two-user test matter more than the anonymous one?

Because an anonymous request is refused by a correct policy and by a broken one alike. Row-level security that is enabled but does not isolate users — a policy that checks a column that is always true, or one missing a with-check clause on insert — looks perfect from the outside and hands every customer's rows to any account that signs up. The only test that separates those two states is signing in as two different users and trying to read one's data with the other's session. BreachProbe and LaunchGuard both do it. Suparbase can reach the answer through its RLS debugger, which will “simulate SELECT/INSERT/UPDATE/DELETE as any role with custom JWT claims”, but that is a query you write rather than a result it reports, and its scanner proper is the stranger's view. The other two do not publish that they test it at all.

Are free security scanners good enough for a launched app?

For finding the obvious catastrophe, yes. Four of the five here are free to run and all of them will find a table serving rows to the public or a service key left in the bundle. What money buys in this category is not better findings but continuity: LaunchGuard's $29/month re-checks on every deploy and remembers the results, Suparbase's “$12 per user / month” Hosted tier runs a continuous anon-key probe, and BreachProbe's $39 tier re-scans nightly for 30 days. The risk of a free scan is not that it misses things on the day — it is that it happens once.

Can I run any of these against an app I have not deployed publicly?

One. SecurifyAI's RLS scanner is open source and can be run locally or installed as a Firefox or Chrome extension, so it can be pointed at an environment that is not reachable from the internet. The Supabase Security Advisor works on the project regardless of whether the app is public, because it reads configuration rather than traffic, and Suparbase's admin connects to the project directly with a URL and key rather than to the shipped site — but its Security Scanner, like LaunchGuard and BreachProbe, works from something a stranger could reach. That is also exactly the thing those three are testing.

You ship every week and want the check to run itself. LaunchGuard is the only tool in this table that re-checks on every deploy automatically and keeps a history — “Memory: we remember every result and every call you made” — and at $29/month that is cheaper than buying a one-off report every month. It also covers Firebase, which BreachProbe does not.

You have not run anything yet. It is already inside the dashboard you are logged into, it runs on its own, and it sees things no external scanner can — an unindexed foreign key, a table with RLS disabled, a function with a mutable search path. Run it first, whatever else you do. It reads your project's configuration rather than your shipped app, which is why it is a different check and not a lesser one.

You want one tool that both RUNS your Supabase project and watches it, rather than a check you run at launch. Suparbase is the only option in this table that is also a working admin — prod→staging sync, a per-row audit log, inline editing, and a live RLS simulator that can “simulate SELECT/INSERT/UPDATE/DELETE as any role with custom JWT claims”. Its free tier is genuinely free forever for up to 3 connections, and at “$12 per user / month” its Agent Sentry keeps a continuous anon-key probe running, which is the cheapest standing watch here. Its five free tools — a Security Scanner, an RLS generator, a schema visualiser, a type generator and a secret scanner — also need no account at all: “no sign-up, no email wall, and no trial timer.”

You want to read the code that is testing you, or run it against something you cannot expose to a third party. It is the only option here that is open source — “This Supabase RLS scanner is open source and free to use. You can inspect the code, run it locally, and customize it” — which also makes it the only one you can point at localhost or an internal environment.