AI-built app security scanner compare: repo, live URL, and ship-flow

Before you share the link, run a Ship Read on the repo, folder, or ZIP you are about to ship. If you only have a deployed URL, paste it at /app for the outside-view read, then clone the repo for the full read and push gate. Dedicated URL scanners add passive posture checks Seatbelt does not claim. If you handle payments or customer data, do not treat a clean URL scan as permission to skip the repo read.

No. CheckVibe and peers run passive or runtime URL probes. Seatbelt also grades live URLs via outside-view static read (observation framing, honest limits), but the wedge is seven-surface plain English at repo handoff plus optional push gate. Use both if you want deep URL posture and ship-moment proof.

Respect it. Four different products collide on ship* as of July 2026. Name the one you mean before you compare:

• Ship Safe (npm ship-safe v9.5.2, shipsafecli.com): local-first CLI with 29 parallel agents (InjectionTester, AuthBypass, SSRF, SupplyChain, MCP/LLM red-team, SlopSquat, InstallGuard, Supabase RLS, CICD, …). npx ship-safe REPL · audit · ci --threshold + SARIF · red-team --gpt-red · agent fix loop; init hooks. Free MIT core · hosted Pro $9/mo · Team $19/seat/mo. Findings include a vendor self-assigned score and optional vendor /share URL (7-day TTL). ~1.05K npm dl/wk (Jul 2026). That broad local agent/MCP coverage lane is real.
• ShipSecure.io: runtime URL scanner after deploy (headers-only on free tier; Pro $7.99/mo capped at 1000 scans/mo). Not the npm ship-safe CLI. See the ShipSecure row in the named-tools table above.
• shipcheck-cli: launch-readiness + MCP metadata scanner. Not Ship Safe. See the shipcheck-cli on this page.
• Shippingszn: paywall scoreboard motion (pairs bench FP-burden compare ammo). Not a local 29-agent CLI.

Seatbelt is a different moment on the Ship Safe lane: seven surfaces in plain English on your local artifact at the git push boundary, optional deny hooks on --no-verify bypass paths, and a shareable Ship Read link anyone can verify at handoff. Vendor self-assigned score + optional /share URL you mint is not push-boundary proof anyone can open without trusting your terminal. Many teams want both. See a repo sample report for ship-moment proof.

vibe-check-cli covers broad SAST and secret rules with a PR comment bot. Seatbelt prioritizes seven ship-killers in founder English and produces a shareable report URL at handoff. Breadth and triage are different jobs; you can run both.

Respect the instinct. Anthropic's Claude Code Security (Feb 20 2026, limited research preview for Enterprise and Team) reads and reasons about your code the way a human security researcher would, with multi-stage self-verification and nothing applied without human approval. Founders also shop claude code security audit skill and prompt recipes for the same job. Detection is not the wedge: a naive founder audit prompt on a frontier model already finds most planted flaws. Precision is. On our July 2026 agent-audit bench, that prompt wrongly blocked 27 to 33% of known-safe apps as ship-blocking. The Seatbelt engine blocked none of those same cases. Same thirty clean apps: the agent blocked ten, the engine blocked none. Limits on that number: one model (Gemini 3.6 Flash), Fable 5 not in the bench yet, our corpus, single-shot prompt. What still holds without leaning on catch-rate: Seatbelt is deterministic on the same artifact, independent of the model that wrote the code, automatic at git push via hooks, enforcing when you wire deny hooks, and provable with a shareable Ship Read link anyone can verify. Distinct from OpenAI's Codex Security CLI recipe in the FAQ below. Many teams want both.

Respect it. OpenAI's Codex Security CLI (npx @openai/codex-security, Jul 2026 research preview) is a real repo AppSec client: scan a folder or diff, CI and SARIF export, and install-hook can sit on pre-commit and block high findings. That packaging competes for the commit slot. Two limits stay load-bearing: the analysis still calls OpenAI (sign-in or API key; access grant, often Trusted Access), and the input is still a repository path or diff. No domain, no served-bytes read, no estate discovery, and no stranger-forwardable Proof of Read. Seatbelt is a different moment: a seven-surface plain-English read of what you export at git push, optional deny hooks, and a shareable Ship Read link anyone can verify at handoff. Distinct from REA's fleet Codex-review gate in the FAQ below. Many teams want both.

REA runs a probabilistic Codex review as its fleet-policy mechanism. That is REA's review lane, not OpenAI's Codex Security CLI (see the FAQ above). Seatbelt is a deterministic static read of seven surfaces with exit codes and a shareable report. Fleet stacks often use both: LLM review for governance, artifact read for launch-day ship-killers.

Respect it. npm audit catches dependency CVEs, not RLS-off migrations, client Stripe keys, or unsigned webhooks. Under agent-heavy PR volume, AI PR reviewers throttle in five different modes (Jul 2026), and none blocks merge on seven-surface artifact read at git push:

• CodeRabbit pass-check: CodeRabbit Pro fair-usage throttle degrades from 5 to as low as 1 review/hour at 60+ reviews in seven days. When rate-limited, it posts a Review rate limited check that passes by design (never blocks merge on protected branches).
• Greptile flex-skip: Greptile Starter Free includes 50 credits/mo. When projected flex spend hits the Flex Usage Limit, Greptile skips reviews that would incur flex usage until the next billing period (silent skip, merge ungated).
• Qodo credit exhaustion: Qodo Pro Team pools credits at $0.012/credit with headline "No rate limits", but reviews stop at zero credits.
• Macroscope spend-cap silence: Macroscope Code Review is $0.05/KB unified diff (10 KB minimum = $0.50/review; large refactor ~$35). Prepaid balance + auto-refill with monthly hard ceiling (cannot override), per-review cap, and per-PR cap. When a cap hits, reviews halt; commits/PRs during the pause are skipped, not retroactively processed. 1000 free Agent credits/mo (Jul 2026).
• Bugbot neutral-on-findings: Cursor Bugbot posts a neutral check by default when findings land (~$1-1.50/run); merge stays ungated unless you wire a custom block.

Probabilistic diff review on merged PRs is not a deterministic seven-surface artifact read at ship moment. Seatbelt reads keys, database rules, auth, payments, customer data cues, and risky shortcuts in founder English, with optional push gate and shareable proof anyone can verify at handoff. Pairs Git AutoReview, Qodo, and Macroscope PR-review rows on this page. Many teams want both.

Respect it. Git AutoReview Team is a real flat-price PR-review lane: $12.49/mo annual ($149.90/yr) or $14.99/mo monthly for up to 10 members (not per-seat like CodeRabbit), with Free tier 10 AI reviews/day, BYOK, and a human-approval workflow where every AI comment stays a draft until you approve, edit, or reject before it posts to GitHub/GitLab/Bitbucket (Jul 2026). That flat team price and approval-before-publish motion is genuine value for eng teams. Seatbelt is a different moment: a deterministic seven-surface plain-English read of your local artifact at the git push boundary, with optional push gate and a shareable Ship Read link anyone can verify at handoff. Probabilistic diff review on merged PRs is not the same layer as ship-moment proof on what you export. Pairs CodeRabbit and Greptile PR-review rows on this page. Many teams want both.

Platform checks are real but platform-scoped. Platforms differ, no one default covers every builder. v0 has the strongest default gate: Vercel blocks insecure v0 deploys automatically, no setting to turn on. Lovable and Replit share the opt-in critical block band: Lovable workspace admins can enable "Block publishing with critical findings" on all plans (off by default), and Enterprise workspaces can enable a second opt-in "Block publishing with PII" when Sensitive data scanning is on. Replit always runs a security scan before publishing and offers opt-in Block publishing of critical vulnerabilities under Deploy → Advanced (off by default; Replit Project Security Center, July 2026): when On, publish blocks on critical severity until you fix or dismiss; dismissed findings unblock. Both Lovable gates and Replit's toggle are in-platform only and off by default; the shareable proof there is an Aikido connector report shaped for SOC 2 questionnaires, not a plain-English ship read. Lovable also documents in-platform remediation as of July 2026: opt-in auto-fix during agent chat injects eligible Basic-scan error-level findings into chat context and consumes credits (not Deep scan). Security memory persists dismiss, accept, and context edits so the scanner and coding agent reference prior decisions. In Security view, Try to fix all on your current deep-scan filter is free; chat auto-fix consumes credits (Lovable security-view). That is platform remediation inside the builder, not ship-moment gating and not shareable proof at git push. In April 2026 a platform API regression let any authenticated Lovable user read chat history and source on legacy public projects (Feb 3 through Apr 20; fixed Apr 20, per Lovable's incident response). That post also documents that researchers filed valid HackerOne reports starting Feb 22 that were closed without escalation because stale triage documentation still described public chat visibility as intended until a public disclosure Apr 20. That episode was broken access control on shared infrastructure and a disclosure-process miss, not ship-moment gating and not something either opt-in publish block would catch on a cross-platform export. Bolt is the opposite false-green: when it finds nothing or you fixed issues, the Publish menu shows No security issues (Bolt support publish, July 2026). That green line is confidence copy, not v0's deploy block. If issues remain, Bolt alerts with Review security; the publish flow never stops. Base44 sits at the bottom: manual Run Security Scan (not on deploy), no publish block, and Ignore hides findings from the next scan so a green rescan can read false-clean. Base44's own application-security guide prescribes SafeVibes as step 1 of an external URL loop before the in-platform check. Wiz and Aikido deep scans in-platform still do not gate a git push from Cursor or any other host. Either way the gate lives inside one platform's deploy lane. Push from Cursor or any other host and nothing checks the artifact you hand off. Export the synced GitHub repo, rotate if exposure is plausible, and run a ship-moment read before you share. Seatbelt gates your push wherever you build and returns the shareable report at freelancer handoff. For why a green in-platform scan still misses cross-platform handoff, see the platform-skew FAQ below.

Respect it. Every vibe platform ships a real in-platform scanner tuned to what breaks most often on that stack. They are not interchangeable. July 2026 research pins a platform-skew pattern: each native scanner over-indexes on its home failure mode and under-checks the rest.

Each native scanner optimizes in-platform. None reads all seven surfaces at git handoff, gates cross-platform export from Cursor or GitHub sync, or returns shareable proof anyone can verify at handoff. For publish-gate ladder detail (v0 default block, Lovable opt-in, Bolt false-green, Base44 Ignore), see the platform scanning FAQ above. Seatbelt gates your push wherever you build and returns the shareable Ship Read at freelancer handoff. See a repo sample report for ship-moment proof.

Respect it. Lovable documents opt-in auto-fix during agent chat as of July 2026: eligible Basic-scan error-level findings flow into chat context and the agent can patch in-platform. That motion consumes credits and does not apply to Deep scan. Lovable also ships security memory: dismiss, accept, and context edits persist so the scanner and coding agent stop re-flagging what you already judged. In Security view, Try to fix all on your current deep-scan filter is free; chat auto-fix consumes credits (Lovable security-view, July 2026). If Try to fix all is greyed out, Lovable usually means your Deep scan results are stale or out of date, not that you are cleared or that Lovable will not help. Security view requires Deep scan results to be up to date before remediation runs; when your project changes, earlier results are marked outdated. Builders often search for lovable try to fix greyed out when they hit that state. Lovable's own docs also say that No issues found means the latest scan did not surface findings, but it does not guarantee the project has no security risk. That is the same false-green shape as Bolt's No security issues publish menu label. As of July 2026, Deep scan does not run on every edit. You run it on demand from Security view, your workspace Security center, or the publish dialog after Basic scan passes. That on-demand scan does not replace cross-platform Ship Read proof anyone can verify at git push or handoff. A Basic-only green state can still miss code-level issues Deep scan covers. A Jul 2026 audit of 50 deployed Lovable repos found 89% missing Row Level Security on app tables and 34% with service_role keys in client code (DEV tgoldi, Jul 2026). Lovable creates Supabase tables but often does not turn RLS on. That complements HackSafe's 63% critical/high rate on 62 self-reported Lovable app audits (Feb 2026). Real in-platform remediation. It still lives inside Lovable: no cross-platform git push gate, no seven-surface artifact read at handoff, no shareable Ship Read link anyone can verify when you export to Cursor or clone GitHub. Seatbelt reads the synced repo at the push boundary with proof you can forward.

v0's gate is real and on by default. Vercel reports over 100k insecure deployments blocked, including 17k in 30 days on exposed secrets alone, with NEXT_PUBLIC_ variable misuse the top blocked class (Vercel blog, August 2025). Respect it. It covers the v0 to Vercel deploy lane, focuses on secrets and config, and produces a block, not a shareable report or badge. Export the repo or build anywhere else and nothing gates the push. Seatbelt reads the artifact on any platform and returns proof you can hand off.

Bolt's Security Audit tab scans database rules and secrets inside Bolt, runs automatically on publish, and offers one-click fixes. When Bolt finds nothing or you fixed issues, the Publish menu shows No security issues (Bolt support publish, July 2026): a green confidence line, not a deploy block like v0's automatic Vercel stop. If issues remain, Bolt alerts with a Review security link to Settings; the publish steps never block. Export to GitHub or push from Cursor and nothing gates the artifact. You still need a ship-moment read with shareable proof at handoff.

Replit always runs a security scan before you publish. Respect it. Opt-in Block publishing of critical vulnerabilities (Deploy → Advanced, off by default) blocks on critical severity until you resolve or dismiss; dismissed findings unblock publish (Replit docs, July 2026). Security Agent grades in-platform only. No shareable plain-English cleared-report link at handoff. Sync to private GitHub, clone, and path-scan the checkout (never a Repl URL). That export path is still ungated. Seatbelt reads the artifact at the push boundary with proof you can forward.

Base44's Security tab runs on all plans, including free: data permission gaps, exposed credentials, login gaps, package vulns, and security headers, with one-click Fix. The scan is manual (Run Security Scan in Dashboard → Security), not automatic on deploy, and it does not block publish. Ignore moves an issue to Ignored and it will not reappear on the next scan, so a green rescan can read false-clean after you dismissed a real gap. Base44's own application-security guide prescribes SafeVibes as step 1 of an external URL loop before the in-platform check. SafeVibes is their endorsed outside view; Seatbelt is cross-platform ship read plus shareable proof link anyone can verify when you export or clone and push from Cursor.

ScanVibe offers unlimited free URL scans with no signup, Pro at $9/mo for monitoring and badges, and Business at $29/mo for multi-page crawl plus CI/CD score-threshold deploy block (Jul 2026). URL-first passive checks. Seatbelt also grades live URLs at /app. Repo export unlocks the full read and push gate; outside view alone uses observation framing.

ScanMyVibe offers four free URL scans per month with no signup (schema.org offers, Jul 2026), passive/runtime URL probe, plus Pro $29/mo and Enterprise $79/mo. Seatbelt also accepts a live URL at /app (outside view). The full seven-surface read, shareable proof, and optional push gate need the repo, folder, or ZIP export.

Respect it. ShipSecure Pro at $7.99/mo is the cheapest full runtime URL scan tier in this cluster: six checks in about 30 seconds with shareable reports, capped at 1000 scans/mo (not unlimited; Jul 2026). Their free tier is headers-only: one of six checks, five scans per month, no shareable reports. That is an honest freemium wedge. Seatbelt also accepts a live URL at /app (outside view) but the ship-moment wedge is seven surfaces on the repo you export, shareable proof, optional push gate. Runtime crawl after deploy and artifact read before you share the link are different layers.

Most tools cover one or two layers. Seatbelt runs repo, folder, ZIP, and live URL outside-view Ship Reads, seven surfaces in plain English, shareable proof, optional push gate. Dedicated URL scanners add passive posture depth and runtime crawl. DAST (Perfai) is a different job again. Match the tool to the moment; do not treat a URL-only read as permission to skip the repo export. See a repo sample report and an outside-view sample report. The full method is public: how Seatbelt scans.

Deterministic rule hits are real value. They are not the same as ship-killer prioritization in founder English. vibe-check-cli covers broad SAST breadth with a PR comment bot. Seatbelt triages seven surfaces, parks flagged pushes, and returns a shareable report URL at handoff. You can run both.

Shiplight owns the parent "how to test a vibe-coded app before launch" query with a 10-step workflow where security is step 10. Seatbelt automates that security step: a plain-English seven-surface read before you share the link. Adjacent, not competitive.

Respect it. Perfai's live-attack DAST lane finds real access-control breaks on a deployed URL. That is a different layer than a static read of the ship artifact before the link goes out. Perfai's own launch reviews concede the black-box motion's costs: browser automation loops bottleneck on rate-limiting firewalls and MFA gateways; the Fix Agent "addresses symptoms rather than underlying software designs," and merging auto-generated patches without senior structural oversight risks convoluted dependency layers (Product Hunt reviews, Daniyal Khamzin, Jul 2026). Seatbelt reads what you are about to ship, in git, before you share the link: no attack traffic, no auto-merged patches, human keeps structural judgment, shareable proof link.

The URL scanner cluster is crowded, and pricing has moved up-market: vas retired per-scan $5/$19 for Free / Go $19/mo / Pro $39/mo (partial-free first scan); CheckVibe Free plus Starter $29 / Pro $59 / Max $129 (Jul 2026 raise); ScanVibe Free unlimited plus Pro $9/mo and Business $29/mo CI/CD; VibeEval Pro $49 / Team $149 / Lifetime $499 with a 14-day no-card trial; Mosai's pay-per-report unlock at R$47; free DB-exposure scans like SafeVibes ($0; Jul 2026); trust-score bundles like VibeProof (Solo Launch $4.99/mo with moltbot75 promo); live self-serve monitoring like VibeScan (tryvibescan.dev) (Free $0 · Pro $19/mo); paste-code demos like getvibescan (/scan live, paid still waitlist); and headers-only free tiers like ShipSecure (1 of 6 checks on $0, 5 scans/mo). Full runtime on ShipSecure Pro is $7.99/mo with up to 1000 scans/mo, not unlimited. Respect what they do: passive checks, TLS, sometimes runtime crawl, vendor scan grades, and AI fix prompts. Mosai's own FAQ says they do not authenticate or test IDOR, tenant isolation, or internal access controls (scan.mosai.com.br). Seatbelt also accepts a live URL at /app (outside-view read, observation framing) but does not claim Mosai-class passive breadth. The wedge is seven-surface plain English on the repo you export, shareable proof anyone can verify at handoff, optional push gate. Vendor scan grade + fix prompts are not push-boundary shareable proof. Not a cheaper URL scanner.

Respect it. VibeProof and peers run a real outside view after deploy: exposed keys in client bundles, unprotected endpoints, TLS, and more. VibeProof bundles security with SEO, mobile UX, and performance into one Trust Score (50+ checks, AI fix prompts, Solo Launch $4.99/mo with moltbot75 promo, Jul 2026). That post-deploy grade is genuine value for live-site hygiene. Seatbelt is a different moment: a seven-surface plain-English read of the artifact in git before you share the link, with optional push gate and a shareable proof report anyone can verify at handoff. A runtime SEO+UX mixed into a security score after deploy is not the same layer as ship-moment read on what you export. Many builders want both. See repo and URL samples.

Respect it. SafeVibes is a real free URL scan focused on database exposure: exposed tables, record counts, and write access from an anonymous outside view (Jul 2026). Base44's own application-security guide prescribes SafeVibes as step 1 of a security hardening loop before the in-platform Security tab. That external validation lane is genuine. Seatbelt is a different moment: a cross-platform ship read on the artifact in git at the push boundary, with optional push gate and a shareable proof link anyone can verify when you export or clone. External anonymous-access grade after deploy and artifact read before you share the link are different layers. Many Base44 builders want both.

Respect it. VibeDoctor runs 149+ checks on a GitHub repo and live site in ~30s, with a Launch Audit $9 one-time that ends in a plain-language is-this-safe-to-launch verdict and MCP in Cursor, Claude Code, Copilot, and Windsurf (Jul 2026). That launch-verdict lane is real. Seatbelt is a different moment: a static read of your local artifact at the push boundary with optional push gate and a shareable proof link anyone can verify at handoff. Their Guard tier adds AI PR review on GitHub; that is not the same as seven ship-killers in founder English on what you export. Many teams want the launch audit and the push-boundary read.

Respect it. VibeCheck on notelon.ai runs a real dual lane: Source Code Scanner via GitHub API and Live Site Scanner on headers, exposed files, CORS, cookies, and SSL. Free letter grade, no signup. Seatbelt also grades live URLs at /app and runs the full read on repo/folder/ZIP, shareable proof anyone can verify, optional push gate, seven surfaces in plain English. Grade in-browser vs proof at handoff. See repo and URL samples.

Real risk, and the names matter. Four separate supply-chain shapes show up in builder conversations (July 2026):

• Typosquatting: you typo a real package name and install the wrong one.
• Slopsquatting: the model invents a package at codegen and you copy-paste the install. The Jan 2026 react-codeshift hallucination spread to 237 repos via agent skill files (Aikido).
• HalluSquatting: the agent hallucinates a repo, skill, or MCP name at fetch with no human paste. Jul 2026 research reports hallucination rates up to 85% on repos and 100% on skills for trending names; tested agents include Cursor, Copilot, Cline, and Gemini CLI (arXiv, SecurityWeek).
• Dual-namespace collision: two legitimate packages share an unscoped name. @yagyeshvyas/vibeguard and @indicated/vibeguard are different products (see the VibeGuard disambiguation above). Confusion, not malware.

Run Socket or Snyk on your dependencies for registry lookup, malware signals, and install-time skill gates. Seatbelt reads your src/ artifact on the seven surfaces that hurt launches before you share. It is complementary, not a replacement: Seatbelt does not registry-lookup package names. Many teams run both.

Respect it. OX Security VibeSec embeds org security context into AI editors at generation time inside org-managed editors (September 2025). That is real prevent-at-source AppSec for teams on a fleet editor stack. Seatbelt is a different moment: a cross-platform ship read on the artifact in git at the push boundary, with optional push gate and a shareable proof link at freelancer handoff. OX does not gate git pushes from Cursor on exported repos, and does not produce plain-English proof anyone can verify. Many enterprise stacks use both: generation-time guardrails in the editor, ship-moment read on what leaves git.

Respect it. PreToolUse hooks, Cursor beforeShellExecution denylists, and agent-control stacks like Aura (git-native IDE with proof-ledger commits via hooks, July 2026) are real for in-session catastrophic mistakes. Anthropic permissions docs say rules are enforced by the harness, not the model. Session hooks block commands at the harness layer. They do not read the seven-surface build you export. A documented gap: PreToolUse hooks silently skip Bash from subagents spawned via the Agent tool (anthropics/claude-code#43612, closed not_planned May 2026). Terminal commits, other agents, and human pushes can bypass session-only hooks. Seatbelt is a different moment: a cross-platform Ship Read on the artifact in git at the push boundary, with optional push gate and shareable proof anyone can verify at handoff. Many fleet stacks use both: session hooks for blast radius, artifact read for what leaves git. See a repo sample report for ship-moment proof.