VibeAppScanner Alternative: Criteria for Choosing a Vibe-Coded App Scanner
Updated 2026-10-17
Scanners for AI-built apps differ mostly in scope (deployed site vs source code), evidence quality and remediation help. We only describe ShipGuard's own features here. We don't make claims about other products' features, pricing or accuracy — they change, and you should check each vendor's current documentation. Use the criteria below to evaluate any scanner, including ours.
| Criterion | ShipGuard | VibeAppScanner |
|---|---|---|
| What is scanned | Deployed public site (HTML, same-site JS bundles, headers, well-known paths) | Check VibeAppScanner's documentation |
| Requires repo / account access | No | Check VibeAppScanner's documentation |
| Active testing (logins, fuzzing) | No — passive only | Check VibeAppScanner's documentation |
| Stack-specific fix prompts (Lovable/Bolt/Cursor/v0) | Yes | Check VibeAppScanner's documentation |
| Supabase RLS SQL generation | Yes | Check VibeAppScanner's documentation |
| Embeddable production badge | Yes (Verified Production-Safe, Vibe-Guard) | Check VibeAppScanner's documentation |
| Heuristic vs confirmed labelling | Yes, per finding | Check VibeAppScanner's documentation |
| Price | Free scan; Launch Pass $29 one-time; Vibe-Guard $99/yr | Check VibeAppScanner's pricing page |
What ShipGuard does
- Scans the deployed public URL passively (read-only GET requests, ~25s budget, 8s per-request timeout).
- Checks: secrets in client bundles (Stripe sk_live_/rk_live_, OpenAI sk-proj-, Anthropic sk-ant-, Supabase service_role / sb_secret_, Resend re_), Supabase schema & bucket enumeration with the public anon key, public .env/.git/source maps (content-validated), HSTS/CSP/X-Frame-Options/nosniff/HTTPS/CORS.
- Every finding is labelled Heuristic match (pattern in public files) or Confirmed (observed in an HTTP response).
- Copy-paste fix prompts tailored for Lovable, Bolt, Cursor and v0.
- Supabase RLS SQL generator — in reports for enumerable tables, and as a free tool at /tools/rls-generator.
- Verified Production-Safe badge for Continuous Vibe-Guard subscribers while their latest scan (≤35 days old) grades A or B.
- Detected secrets are redacted to the first 6 characters before storage.
Questions to ask any vendor
- Does it store detected secrets? In what form?
- How does it avoid false positives from SPA catch-all pages that return 200 for every path?
- Does it say when a result is a heuristic guess?
- Does it require repository or database credentials?
- Can it produce fix steps for the tool I actually build with?
FAQ
Is ShipGuard affiliated with VibeAppScanner?
No. This page does not describe VibeAppScanner's features; check their documentation.
Does ShipGuard read my database?
No. With your public anon key it only checks whether the schema and bucket list are enumerable; it never reads rows or objects.
Check your deployed app in ~25 seconds
Free passive scan: leaked keys, Supabase exposure, public config files and headers.
Run a free scan