Rustine
I'm an agencyFR

Rustine or Aikido: which one is made for you?

Checked on 15 October 2026 · 4 min

Contents

Aikido is a security platform for development teams: code, dependencies, containers, cloud, dynamic testing, compliance. Rustine does far less, for someone who shipped an app without a security team. Comparing them point by point is mostly about knowing which one fits your situation.

Facts read on 15 October 2026 on Aikido's site and help center, linked in the table and at the foot of the page. Aikido shows prices by region: we quote the euro ones. Plans change: check their site before you choose. Spotted a mistake? Write to hello@rustine.io and we'll fix it.

Point by point

CriterionRustineAikido (read on 15/10/2026)
Who it's forVibecoders, freelancers and small agencies, including people who don't code.Developers, security teams and CISOs of an organisation. [1]
What it coversYour site seen from outside, your Supabase or Firebase database after proof, your GitHub code, and the known flaws of your versions.Code (SAST, dependencies, secrets), containers, cloud, infrastructure as code, dynamic testing (DAST) and runtime protection. [1][2]
Free plan1 project, 10 quick scans a month, 3 free fixes. A scan with no account.Developer, free: 2 users, 10 repositories, 1 domain, 1 cloud account, 10 AI AutoFixes a month, rescans every 3 days. [2]
Paid plansSolo €19, Pro €49 a month, VAT included.Basic 300 euros, Pro 600 euros, Advanced 900 euros a month, for 10 users, taxes excluded. 10% off yearly. [2]
CodeGitHub, read-only, Solo and Pro: JavaScript, TypeScript, Python, PHP, Swift (iOS), Kotlin (Android).GitHub, GitLab, Bitbucket, Azure Repos. About twenty languages, Java, Go, C#, Rust, Swift, Kotlin and Dart among them. [4][3]
Live site testsWhat a visitor sees, then, after proof, your database and APIs, read-only. No injection, no exploitation, ever.A daily DAST; APIs receive controlled malicious payloads; an authenticated mode logs in as a real user. [5]
Proof of ownershipRequired before any active test: DNS, meta tag or file.Yes for attack surface monitoring: a DNS record (CNAME or TXT) proves the domain is yours. [6]
SupabaseAfter proof, the rows the anon key can read counted without reading one. With Supabase connected: your policies read one by one.Surface monitoring finds the anon key in the site's code and checks table exposure. [6]
WordPressThe plugins and themes visible on your page, matched against the Wordfence vulnerability database.Plugins scanned in the code or the Docker image, based on the Wordfence database. [7]
Fixes and AI agentsA prompt to paste into your agent, AI Fix with Solo and Pro, an MCP server (14-day trial with Solo, full with Pro).AI AutoFixes, plugins for VS Code, JetBrains, Cursor and Windsurf, and an MCP server for Claude Code, Cursor or Codex. [2][8][9]
ComplianceNo compliance report: a PDF security report with Solo and Pro.SOC 2 and ISO 27001 reports. Aikido itself is ISO 27001:2022 and SOC 2 Type II certified. [10][11]
Publisher, law, hostingMBEN DEV, a French SARL. French law. The app, the API and the database in Finland (Hetzner), scans in Paris.Aikido Security BV, in Ghent. Belgian law. Servers at AWS, data in the chosen region (EU, US…); code isn't kept after analysis. [1][12][13]

What Aikido does better

  • Everything in one place for a team: code, dependencies, containers, cloud and dynamic tests, in about twenty languages. [1][3]
  • Plugged into a team's tools: GitLab, Bitbucket, CI, Jira, Slack, and the Vanta and Drata compliance platforms. [4][2]
  • Compliance: SOC 2 and ISO 27001 reports, from a vendor that is certified itself. [10][11]
  • A generous free plan for a developer: 10 repositories and 2 users, no card. [2]
  • For Lovable apps, an AI pentest at $100 a test, at the launch price. [14]

Where Rustine is simpler

  • No repository or team needed: you paste your site's address and get a first result, no account.
  • A price made for one person, VAT included, rather than a team bundle.
  • Tests that stay read-only after proof, with no malicious payload sent to your APIs.
  • Firebase: Realtime Database, Storage and Firestore tried for anonymous reads, and open rules spotted in your code.
  • Explanations written for people who don't code, in French, with the fix ready for your AI agent.

Who should pick which

  • Aikido, if you have a developer team, cloud and containers to watch, or a SOC 2 or ISO 27001 audit to pass. [1][10]
  • Rustine, if you shipped an app alone or with a small team, with Lovable, Bolt or Cursor, and want to know what a stranger can read on it, without installing anything.
  • Your project is growing? Starting with Rustine and moving to a team platform such as Aikido later is a natural path.

Scan your site, it's free

Paste your address: the quick scan reads what a visitor sees, nothing more. The details show once you've proven the site is yours.

Free toolsSecurity headers test

Questions

Is Aikido a competitor of Rustine?

Only partly. Aikido equips development teams; Rustine speaks to people shipping an app without a security team. If you have both needs, the two tools add up.

Why is Rustine cheaper than Aikido?

Because it does far less: no containers, no cloud, no compliance, no 10-person team. It focuses on your site, your database and your code.

Sources

  1. Aikido Security, Home page, read on 15/10/2026
  2. Aikido Security, Pricing, read on 15/10/2026
  3. Aikido Security, SAST/IaC: Supported Languages and Security Focus, read on 15/10/2026
  4. Aikido Security, Integrations, read on 15/10/2026
  5. Aikido Security, Dynamic Application Security Testing (DAST), read on 15/10/2026
  6. Aikido Security, Attack Surface Monitoring (help center), read on 15/10/2026
  7. Aikido Security, WordPress security, read on 15/10/2026
  8. Aikido Security, IDE Integrations, read on 15/10/2026
  9. Aikido Security, AI Coding Assistants (MCP), read on 15/10/2026
  10. Aikido Security, SOC 2 and ISO 27001 compliance, read on 15/10/2026
  11. Aikido Security, Trust Center, read on 15/10/2026
  12. Aikido Security, Terms of Use, read on 15/10/2026
  13. Aikido Security, Aikido Never Stores Your Code, read on 15/10/2026
  14. Aikido Security, Aikido & Lovable: AI Pentest for Lovable Apps, read on 15/10/2026