Vibe coding
Best security scanners for vibe-coded apps
Almost every “best scanner” list recommends the same CI pipeline: Semgrep, CodeQL, Gitleaks, Trivy, OWASP ZAP. That is good tooling. It also assumes you have a git repository and a build pipeline, and if you deployed straight out of Lovable, Bolt, v0 or Replit, you have neither.
Last reviewed April 20, 2026
The mismatch: the standard advice targets teams with pipelines. The people shipping the most AI-generated code are often deploying from a chat window.
What actually breaks: not exotic vulnerabilities. Missing access control on a database table, secrets in the frontend bundle, and absent headers. All three are visible from outside the app.
If you only have a URL
These work without source access, a repo, or a pipeline. Two of them are free and built into the platform you are already using.
vas
Checking a deployed app when you have only a URL · Free first scan, paid plans after
- Supabase and Firebase backends left readable to the public key
- Secrets and service_role keys shipped in the JavaScript bundle
- Missing security headers, unprotected API routes
- SPF and DMARC gaps on the domain
Does not catch: It sees the deployed surface, not your source. It will not find a vulnerable dependency or a secret sitting in git history.
Supabase Security Advisor
Any app with a Supabase backend, run it today · Free, built in
- Tables with RLS disabled
- RLS enabled but no policy attached
- Public storage buckets
Does not catch: Supabase only, and it reads your schema rather than your deployed app.
DocumentationFirebase Security Rules simulator
Any app with a Firebase backend · Free, built in
- Rules that allow unauthenticated reads or writes
- Overly broad wildcard matches
Does not catch: Firebase only, and it tests the rules you point it at rather than finding the gaps.
DocumentationOWASP ZAP
Generic web testing if you are comfortable with security tooling · Free, open source
- XSS and injection
- Missing headers
- Auth handling flaws
Does not catch: Steep learning curve, and it does not understand backend-as-a-service platforms. It will not enumerate your Supabase tables.
DocumentationIf you have a repo and a pipeline
Once your project has a git repository, the conventional stack becomes available and it is worth adopting. All of these are free for small projects.
| Tool | Best for | Blind to |
|---|---|---|
| Gitleaks | Finding secrets in a repo, including in history | Needs a repo. Also flags public-by-design keys like NEXT_PUBLIC_SUPABASE_ANON_KEY, so expect noise. |
| Semgrep | Source-level rules in CI once your project has grown up | Needs a repo and a pipeline. Cannot see runtime or database configuration. |
| Trivy | Known CVEs in your dependencies | Unrelated to access control, which is where AI-built apps usually fail. |
Where AI-built apps actually fail
Benchmarking of agent-generated code has consistently found that functionally correct output is frequently still insecure (see Is Vibe Coding Safe? Benchmarking Vulnerability of Agent-Generated Code and Understanding the (In)Security of Vibe-Coded Applications). The recurring pattern is not exotic: authorization checks that were never written, placeholder logic that was never replaced, and credentials written into client-side code.
None of these stop the app from working, which is precisely why they survive to production. Nothing in the development loop surfaces them, and the AI has no reason to mention a check it did not write.
Scan a deployed app
vas takes a URL. It reads what your live app exposes, including the backend behind it, and reports what an anonymous visitor can actually reach. Your first scan is free.
Common questions
What is the best security scanner for a vibe-coded app?
It depends on whether you have a git repository. Most published advice recommends a CI-based stack (Semgrep, CodeQL, Gitleaks, Trivy, OWASP ZAP), which is genuinely good tooling but assumes a repo and a pipeline. If you deployed straight from Lovable, Bolt, v0 or Replit, none of it runs. In that case start with your platform's own free checks, Supabase Security Advisor or the Firebase Rules simulator, then add an external scanner that works from a URL.
Can I scan an app if I only have the URL?
Yes. A deployed application exposes a large amount of information by design: its JavaScript bundle, its API responses, its headers, and any backend it talks to. An external scanner reads the same things any visitor can and reports what answers. This is the only option if you do not have access to the source.
Do free security scanners find real problems in AI-built apps?
Often, yes, because the most common problems are not subtle. Missing access control on a database table, a secret in the frontend bundle, and absent security headers are all detectable by free tools. Supabase Security Advisor and the Firebase Rules simulator cost nothing and catch the highest-severity category. Run them before paying for anything.
Why do AI coding tools produce insecure code?
Models optimise for code that works, and security is not the same goal as functionality. Academic benchmarking of agent-generated code has repeatedly found that functionally correct output is frequently still insecure. In practice the recurring failures are missing authorization checks, placeholder logic that was never replaced, and secrets written into client-side code. None of these break the app, so nothing surfaces them during development.
Is one scanner enough?
No, and any page that tells you otherwise is selling something. Scanners see different layers: your repository, your source, your dependencies, your database configuration, and your deployed app. A tool that reads one layer is structurally blind to the others. Two or three complementary free tools beat one paid tool used alone.