URL scanners vs source-code scanners for vibe-coded apps: which do you need?

There are two kinds of security scanner for apps built with AI tools. One tests your live site from the outside. One reads your code. They catch different things, and most people are better off running one of each. This page explains the difference in plain words and lists both kinds with facts checked against each vendor’s own site.

Every “best scanner” list in this corner of the web is written by a scanner company that ranks itself first. This one is written by a scanner company too (Epherem, which is a source-code scanner), so it is laid out so you can check it: each fact below was read off the vendor’s own page on the day in the byline, the page and date are listed under the table, and where a vendor’s page doesn’t say something, the cell says not stated rather than guessing.

The two kinds, in one paragraph each

A URL scanner visits your deployed app the way a stranger would. It loads the pages, looks at the JavaScript your browser downloads, tries your public database endpoint with the public key, and checks headers, cookies and certificates. It sees what an attacker sees. It can’t see code that never reaches the browser, and it can only test what it can reach.

A source-code scanner reads your project’s files: routes, database queries, policy files, settings, the package list. It can see a login check that’s missing from one route but present on nine others, an ownership check that was never written, a service-role key sitting in a file that gets bundled into the browser, and a package version with a published advisory. It can’t see how your live site behaves, or what you set in a dashboard.

What each one catches that the other can’t

URL scanners catch: a key that only appeared in the bundle at build time; a Supabase table that really is readable with the public key right now; a missing security header set by your host; a cookie flag; a certificate problem.

Source-code scanners catch: a route with no login check; a query with no ownership check; a key in a file that hasn’t been deployed yet; a policy file that grants too much; a dependency with a known issue; a “temporary” bypass that’s still in the code.

Neither kind can tell you your app has no problems. Both can show you things to fix.

Which do you need?

If your app is live and you’ve never scanned it: run a URL scanner first, because it tests what’s exposed today. Then run a source-code scanner, because the next deploy will ship whatever is in your code.

If your app isn’t live yet, or you build with Cursor or Claude Code and there’s no platform scan: a source-code scanner is the one you can run now.

If you build with Lovable: Lovable’s built-in scans and Supabase’s Security Advisor are already there and cost nothing to run. Run them, then run a source-code scanner on the GitHub repo Lovable syncs.

The tools, side by side

Platform built-ins first, then URL scanners, then source-code scanners. Not ranked. Prices are the lowest paid tier on the vendor’s page, monthly, in the currency the page shows. The AI in pipeline column says only what the vendor’s own page states about a model reading your code or your findings.

Lovable built-in scan

Reads the Lovable project: a quick scan of database rules, dependencies and MCP exposure runs on every publish, and a deep scan of the app code runs on demand. Both are free to run. The workspace-wide Security center needs a Business or Enterprise plan, and the optional Aikido pentest is billed by Aikido. It is already there if you build with Lovable. It covers only Lovable projects.

Supabase Security Advisor

Reads your Supabase project’s settings from inside the dashboard: tables with RLS off, RLS on with no policy, public buckets that allow listing, exposed columns and more. It runs by itself and costs nothing extra. It knows the real state of your database, which no outside scanner can be sure of. It knows nothing about your application code.

CheckVibe

Scans a live site and bundle, and a connected GitHub or GitLab repo. The URL scan is free with a free account; every paid plan starts with a 14-day trial, and Starter is $24 a month for one project and ten scans a month. It is one of the few tools that does both kinds in one place. Its subprocessors page says scan-finding text is sent to Google’s Gemini API.

Vibe App Scanner

Scans a live site: the bundle, headers, and Supabase and Firebase probes. The first scan is free, with one finding shown in detail and the rest locked; Go is $29 a month. It tests Supabase and Firebase from the outside the way an attacker would. It reads no source code, by design.

VibeEval

Tests a live site; its page says autonomous AI agents probe the app and a security engineer verifies findings before delivery. Fourteen days of Pro free with no card, then $25 a month. Findings come with reproduced evidence. It needs a deployed app to test.

ScanVibe

Scans a live site with no sign-up: certificates, headers, exposed keys, exposed files, library versions and Supabase and Firebase rules. Free and unlimited, every check shown; Pro is $9 a month for monitoring, badges and history. The quickest free outside check in this list. It can only see what the live site serves.

Reeve

Scans a live site with nine read-only checks and no sign-up, and gives a letter grade. The scan is free; Monitor is $12 a month and Care, with database backups, $49 a month. Its own 2026 sweep of thirty thousand live apps is published on the site. A grade is a summary of nine outside checks, not a review of your code.

vibecheck

Reads a GitHub repo through OAuth and runs Gitleaks, Semgrep, njsscan and its own Supabase RLS and unauthenticated-route checks. Free for two repos, showing severity counts and finding titles only; Solo is £12 a month for full explanations. It bundles three well-known open-source scanners you would otherwise set up yourself. Its page says Claude explains findings and suggests fixes.

Semgrep

Reads your repo. The Community Edition runs on your own machine; the Free Edition in the cloud covers up to ten private repos and ten contributors, and Teams starts at $30 a month per contributor. Cross-file analysis and a large public rule registry. Its AI detection and fixes are opt-in; when on, its pricing page says part of the file with a finding goes to a model. Written for developers, not for someone who doesn’t read code.

Snyk

Reads your repo for vulnerable dependencies (Snyk Open Source) and code issues (Snyk Code). Free for five projects with one hundred Snyk Code tests a month; Team is $25 a month. One of the largest vulnerability databases. The plans page does not say whether a model reads your code.

GitHub: Dependabot, secret scanning, CodeQL

Reads your GitHub repo. Dependabot alerts and security updates come with every plan; secret scanning and CodeQL code scanning are free on public repositories and need GitHub Secret Protection or GitHub Code Security on private ones (Team and Enterprise Cloud). It is already in your repo if the repo is public. On a private repo most of it is a paid add-on.

Epherem

Reads a GitHub repo (read-only) or a ZIP, runs 55 deterministic checks and looks up lockfile-pinned JavaScript and Python packages on OSV.dev. The full report is free with nothing hidden, five scans a day, free during early access. Every finding comes with the file, the line, what someone could do, a suggested fix and a prompt for your AI tool. It reads JavaScript and TypeScript better than Python, and it never sees your live site.

Where Epherem fits, and where it doesn’t

Epherem is a source-code scanner. It connects to GitHub read-only or takes a ZIP, runs 55 deterministic checks, looks up lockfile-pinned packages on OSV.dev, and shows everything it found: the file, the line, what someone could do, a suggested fix and a prompt for your AI tool. The full report is free with nothing hidden, and no AI reads your code. Findings are split into likely issues (the scanner saw the risky code itself) and findings that need checking (it looked for a protection and didn’t see it, or the match depends on context it can’t see).

It doesn’t test your live site, can’t verify whether a Supabase policy is enforced in production, and reads JavaScript and TypeScript better than Python. For the things it can’t see, use a URL scanner or check the dashboard; the report names what it couldn’t check.