Security tools for vibe-coded apps.
33 real tools, grouped by the job they do. For each one we checked the free tier and starting price on the tool's own site. Most of what a new app needs is free.
How this list works. Rankings and picks are editorial. Sponsorship never changes them. Paid placements are labeled “Sponsored”. We don't use affiliate links; if we ever add one, we'll say so next to it and mark it rel="sponsored". Prices change, so check the tool's site before you buy.
Secret scanning
Find API keys and tokens in your repo and its history before someone else does.
Best for: Finding keys anywhere in your git history, then checking whether each one still works.
Why it's our pick: It tests whether each key it finds is still live, so you know which ones to rotate first.
Price: Free and open source. Enterprise: see pricing
Best for: Repos already on GitHub. Push protection blocks known key formats before they land.
Price: Free on public repos. Private org repos: $19 per active committer/mo (GitHub Secret Protection) Pricing
Best for: A fast pre-commit or CI check for keys. Feature-complete: new releases are security patches only.
Price: Free and open source
Best for: Small teams that want alerts and a dashboard across every repo.
Price: Free for up to 25 developers. Paid plans: see pricing
Dependencies and supply chain
AI tools add packages fast. These tell you when one is vulnerable, abandoned or malicious.
Best for: Automatic pull requests that patch vulnerable dependencies on GitHub.
Why it's our pick: It's free, already built into GitHub, and turns alerts into pull requests you can merge.
Price: Free on all GitHub repositories
Best for: Catching malicious or hijacked npm packages before they reach your code.
Price: Free plan. Team: $25 per dev seat/mo, or $20 billed yearly Pricing
Best for: One account covering dependencies, your own code, containers and infrastructure files.
Price: Free plan. Team: from $25/mo Pricing
Best for: A no-account command-line check of your lockfiles against the open OSV.dev database.
Price: Free and open source
Best for: A first check on any Node project, with nothing extra to install.
Price: Free, built into the npm CLI
Best for: Keeping every dependency current, with detailed rules for grouping and scheduling updates.
Price: Free and open source
Code scanning (SAST)
Static analysis reads your source for injection, unsafe auth checks and other mistakes AI tools repeat.
Best for: Readable rules that catch injection and auth mistakes in JavaScript, TypeScript and Python.
Why it's our pick: Free for small teams, quick to add to CI, and its rules are short enough to read and adapt.
Price: Free for up to 10 contributors and 10 repos. Teams: from $30 per contributor/mo Pricing
Best for: Deep data-flow analysis on GitHub, with suggested fixes on pull requests.
Price: Free for public repos. Private: $30 per active committer/mo (GitHub Code Security) Pricing
Best for: Code quality and security issues together in one pull-request check.
Price: Free for private projects up to 50k lines of code. Team: from $34/mo Pricing
Headers, TLS and live-site testing
Check what your deployed app tells the world. Run active scanners only against apps you own or have written permission to test.
Best for: A letter grade for your security headers, CSP, cookies and redirects, with what to fix.
Why it's our pick: Free, no sign-up, maintained by Mozilla's MDN team, and a clean grade is a fast first win.
Price: Free, no account needed
Best for: A quick second opinion on your response headers.
Price: Free
Best for: An in-depth check of your TLS certificate and HTTPS setup.
Price: Free
Best for: Active testing of a staging copy of an app you own: crawls it and probes for common flaws.
Price: Free and open source
Best for: Template-based checks for known misconfigurations and published CVEs.
Price: Free and open source. Free cloud tier available
Supabase and Firebase checks
Most vibe-coded apps keep their data here. The rules on that data matter more than any header.
Best for: Flagging tables with RLS off, an exposed auth.users table and other database risks.
Why it's our pick: It's already in your Supabase dashboard and flags missing row-level security, the mistake behind CVE-2025-48757.
Price: Included with Supabase (dashboard, CLI and MCP)
Best for: Running Supabase's own database lints as plain SQL, for example in CI.
Price: Free. Source on GitHub
Best for: Proving your Firestore and Storage rules block other users before you deploy.
Why it's our pick: Rules are where Firebase apps leak. Tests in the local emulator show they hold before you ship.
Price: Free, runs locally in the Emulator Suite
Best for: Checking that requests to your Firebase backend come from your real app.
Price: No cost, within quotas set by each attestation provider Pricing
Secrets managers
Keep keys out of your code, your prompts and your chat history.
Best for: Syncing secrets to your hosting and CI from one dashboard.
Why it's our pick: The free plan covers a founder and two collaborators, and it gets keys out of .env files that get pasted and committed.
Price: Free for 3 users ($8/mo per extra user). Team: $21/user/mo Pricing
Best for: An open-source secrets manager you can use hosted or run yourself.
Price: Free for 5 identities. Pro: $20 per identity/mo billed annually Pricing
Best for: Encrypting your .env files so the ciphertext is safe to commit.
Price: Free and open source
Firewall and bot protection
Put a filter in front of your app so bots and known attack patterns don't reach it.
Best for: A firewall and DDoS protection in front of any site, including on the free plan.
Why it's our pick: The free plan alone adds unmetered DDoS protection and a managed ruleset in front of your app.
Price: Free plan includes the Free Managed Ruleset. Pro: $20/mo billed annually Pricing
Best for: Stopping bots on sign-up, login and contact forms without a CAPTCHA puzzle.
Price: Free: unlimited challenges, up to 20 widgets Pricing
Best for: Apps already on Vercel: IP blocks and custom rules at the edge.
Price: Included on all plans. Hobby: up to 3 custom rules Pricing
Authentication
Don't let an AI write your login from scratch. Use a library or service that handles sessions and passwords for you.
Best for: Apps whose data already lives in Supabase.
Why it's our pick: If your data is in Supabase, its auth plugs straight into row-level security, and the free plan covers 50,000 monthly users.
Price: Free up to 50,000 monthly active users. Pro: from $25/mo Pricing
Best for: Prebuilt sign-in, sign-up and profile screens you can drop into a React or Next.js app.
Price: Free up to 50,000 monthly retained users per app. Pro: $25/mo, or $20 billed annually Pricing
Best for: Open-source auth for Next.js and other web frameworks, with many sign-in providers.
Price: Free and open source
Best for: A TypeScript auth framework that runs inside your app, on your own database.
Price: Free and open source
Error monitoring
Know when something breaks or starts failing in production, before a user tells you.
Best for: Errors, failing requests and traces from your live app, in one place.
Why it's our pick: The free plan covers a solo founder and shows you errors the moment real users hit them.
Price: Free for one user. Team: $26/mo billed annually Pricing
Not sure which of these your app actually needs?
Our free scan reads what any browser can see on your live app and emails you your top 3 risks. Free scans open soon, so join the waitlist. The Launch Audit goes further, only with your signed scope authorization: whether your access rules actually hold, what an attacker could do with each finding, and a fix prompt for each one. It's $119 founding, normally $249.
Questions
What's the minimum security setup for an app built with AI?
A few free steps cover the most common gaps. Turn on secret scanning for your repo. Turn on Dependabot or another dependency checker. Run your live site through HTTP Observatory and fix what it flags. If you use Supabase or Firebase, clear every Security Advisor warning or write rules tests. Then put Cloudflare's free plan or your host's firewall in front of the app.
Do I need paid security tools?
Not to start. Every category on this page has a free option, and most free tiers cover a solo founder or a small team. Paid plans mostly add more seats, private-repo coverage, history and support.
I committed an API key. What should I do first?
Revoke or rotate the key with the provider that issued it, right away. Deleting it from your code or rewriting git history doesn't help once it has been pushed, because copies may already exist. Then add a secret scanner so it doesn't happen again.
Is my Supabase anon key a secret?
No. The anon (public) key is meant to ship in your front end, so your data is only as safe as your row-level security policies. The service_role key bypasses those policies. Keep it on the server and out of the browser, your repo and your prompts.
How do you choose the picks, and can sponsors change them?
Picks are editorial. We favor tools that are free or cheap to start, quick for a solo founder to set up, and fix a problem we often see in apps built with AI. Sponsors can buy a labeled slot at the top of a category, but sponsorship never changes the order of the list or which tool is the pick.
Is running these tools the same as a security audit?
No. Each tool finds known patterns in what it can see. None of them tells you which finding matters most for your app, and most can't check whether your access rules hold, for example whether one user can read another user's data. Our Launch Audit checks that, with your signed scope authorization.