Defexity vs vibecheck
Last updated · 2 min read
vibecheck connects to your GitHub repository and runs Gitleaks, Semgrep and njsscan plus its own checks for things like missing Supabase RLS, with a free plan for two repositories and auto-fix pull requests on its top plan. Defexity starts from the deployed site, adds code checks, gives fix prompts on every plan and monitors sign-up and checkout after deploys.
Side by side
| vibecheck | Defexity | |
|---|---|---|
| Starts from | Your GitHub repository | Your deployed URL |
| Live-site check | Instant header and TLS check (headers, TLS, CORS, cookie flags) | 130+ read-only checks, including secrets in the deployed bundle and exposed files |
| Code scanning | Gitleaks, Semgrep, njsscan and its own checks | Own code rules and OSV.dev dependency checks; ZIP upload on every plan, GitHub on Pro and Agency |
| Free plan | Two repos, unlimited scans, counts and titles only | Free forever: 2 scans per URL per day, every finding with a fix prompt |
| Paid plans | Solo £12/month (5 repos, full fixes), Indie stack £27/month (unlimited repos, auto-PRs) | From $15/month |
| Fixes | Explanations and fixes on paid plans; auto-PR for safe fixes on Indie stack | Fix prompts on every plan; verified rechecks |
| Flow tests (sign-up, checkout) | Not described | Yes, on a schedule and after deploys (paid plans) |
Where vibecheck is stronger
vibecheck runs well-known open-source scanners (Gitleaks for secrets, Semgrep with OWASP rules) over the whole repository, which finds problems in code that never ships to the browser. Its top plan opens pull requests for safe fixes automatically, and it keeps scan history with diffs between scans.
Where Defexity is different
Defexity looks first at what is actually deployed: the JavaScript visitors download, files the server answers for, headers, cookies, privacy pages, accessibility and SEO. A repository scan cannot see a key injected at build time, a file published by a host setting, or a missing header. Fix prompts are included on the free plan, and a finding is marked resolved only when a recheck of the live site passes.
Which to choose
- Most of your risk is in the code and you want automatic fix PRs: vibecheck.
- You want to know what the live site exposes and keep sign-up and checkout working after deploys: Defexity.
- The two overlap little: running a repository scan and a live-site scan together covers more than either alone.
Questions
- Does vibecheck scan live sites?
- It offers an instant header and TLS check for a pasted URL; its main scan is of the GitHub repository.
- Is vibecheck open source?
- Its site says it runs open-source scanners (Gitleaks, Semgrep, njsscan). Whether vibecheck itself is open source is not stated there.
Sources
Defexity reports potential risks it can see from outside your app. It is not a guarantee of security and not legal advice.