Security scanners
LockedVibe
Security review for AI-built web apps covering secrets, Supabase or Firebase policies, auth, and dependencies, plus a free passive leak checker.
Pricing as seen
Quick Review is listed at $29 and only needs a live URL. Other audit prices: See site.
Checked 16 Oct 2026. Prices change. Confirm on the vendor site before you buy.
Pricing sourceUpdated
16 Oct 2026
Added
16 Oct 2026
Supported builders
The site names Lovable, Bolt, v0, Replit, Windsurf, Cursor, and Claude Code, on Next.js or React with Supabase or Firebase.
What it is
LockedVibe reviews apps built with AI tools, with a written report and copy-paste fixes. The homepage says it looks at secrets, Supabase RLS and storage, auth, validation, rate limits, and dependency vulnerabilities. A scan is ordered and then run with read-only access. It is not an instant paste-a-URL product for the paid review.
A separate free leak checker only reads what is already public. Their terms say a good grade from that checker is not proof the app is secure, and that the paid review is not a penetration test or a compliance certification.
Best for: A JS/TS app on Supabase or Firebase whose owner wants a human-in-the-loop review rather than another dashboard.
Watch-outs
- The paid review needs access arranged on purpose. Do not paste service-role keys into the intake form. Their own page says not to.
- They state they do not accept apps that process protected health information.
Our take
Opinion from ShipSafeStack. Not a score, not a certification, and not a sponsorship.
Read the terms before you upload a repo. They are clearer than most about what a review is not. The free checker is a narrow public-content look. The paid review is a job you wait for, which is fine if that is what you wanted and a poor fit if you wanted a self-serve scan tonight.