Security scanners for vibe-coded apps, compared (November 2026)
Last updated · 3 min read
For apps built with AI tools, the main differences are what each scanner reads (the live site, the code, or both), whether there is a free plan, and whether it keeps watching after launch. Lovable’s built-in scan is included for Lovable apps, amihackable.dev is free, vibecheck focuses on code, Vibe App Scanner and Defexity cover both, and Aikido serves teams.
How this comparison was made
Every fact about another product comes from that product’s own website or documentation, reviewed on 13 November 2026; nothing comes from third-party reviews or our own testing of their scanners. Prices and plans change, so check each link before you decide. Defexity wrote this page and is one of the tools listed; the table includes where each tool is the better fit.
Side by side
| Tool | Reads | Free option | Paid from | Fix prompts | Ongoing monitoring |
|---|---|---|---|---|---|
| Lovable security scan | Inside a Lovable project (database rules, code, dependencies) | Included with Lovable | Included | Fixes inside Lovable | No |
| amihackable.dev | Public site | Free, full report | Paid plans planned | Yes | Planned |
| vibecheck | GitHub repository (plus a header and TLS check) | Two repos, counts and titles | £12/month | Paid plans; auto-PR on the top plan | Not described |
| Vibe App Scanner | Live site and code (GitHub or ZIP) | 7-day trial, three scans | $29/month | Yes | Weekly, on Pro ($49/month) |
| Aikido Security | Code, dependencies, containers, cloud, live app | Developer plan (2 users) | $300/month (10 users) | AI AutoFix | Rescans every 3 days on the free plan |
| Defexity | Live site, plus code when uploaded or connected | Free plan, 2 scans per URL a day | $15/month | Yes, every plan | Sign-up, login and checkout flows, after deploys (paid) |
Which one fits
- You build only in Lovable: run Lovable’s scan first; it sees your database rules directly. Add a live-site scan for what the deployed app exposes.
- You want a free one-off check of a public site: amihackable.dev or Defexity’s free scan.
- Most of your risk is in the code and you want automatic fix PRs: vibecheck.
- You want live and code scans with weekly monitoring, breach and email checks: Vibe App Scanner Pro.
- A development team covering code, containers, cloud and runtime: Aikido.
- You want fix prompts on a free plan, fixes confirmed by a recheck, and sign-up and checkout tested after deploys: Defexity.
What no scanner can do for you
A scan from outside cannot sign in as two different users and check that one cannot read the other’s data, and a code scan cannot prove what the deployed site serves. Before launch, test access between test accounts yourself and keep your database rules strict; the pre-launch checklist guide walks through both.
Questions
- Which vibe-coding security scanner is best?
- It depends on what you need to see. For database rules in a Lovable app, Lovable’s own scan; for code, a repository scanner; for what the deployed site exposes and whether key flows keep working, a live-site scanner with monitoring. Using two that read different things covers the most.
- Is a free scan enough before launch?
- It catches the common, costly mistakes: leaked keys, open files, missing headers. It does not replace testing access between user accounts or your payment flow.
- Why is this list short?
- It includes tools whose own sites state what they scan and what they cost. Tools without public pricing or scope are left out rather than guessed at.
Sources
Defexity reports potential risks it can see from outside your app. It is not a guarantee of security and not legal advice.