Rustine or CheckVibe: which one for your app?
Contents
CheckVibe targets developer teams who build with AI, and covers a lot: site, code, pull requests, cloud, even SEO. Rustine focuses on one question, for people who don't necessarily code: what can a stranger read on your app? Here is what each one does, from CheckVibe's pages and Rustine's code.
Facts read on 15 October 2026 on CheckVibe's public pages, linked in the table and at the foot of the page. Plans change: check their site before you choose. Spotted a mistake? Write to hello@rustine.io and we'll fix it.
Point by point
| Criterion | Rustine | CheckVibe (read on 15/10/2026) |
|---|---|---|
| Who it's for | Vibecoders, freelancers and small agencies, including people who don't code. | Developer teams shipping AI-written code, and the agencies building for them. [1] |
| Free scan | Yes, a quick scan with no account. Free account: 10 quick scans a month, 3 free fixes. | The security tools need a free account. The free plan shows half of each list, with the two loudest severities masked. [3][2] |
| Entry paid plan | Solo: €19 a month, VAT included. 1 project, 30 full audits a month. | Starter: $24 a month, 1 project, 10 scans. A 14-day trial with a card. [2] |
| Several sites | Pro: €49 a month, VAT included. 10 projects. | Pro: $49 a month, 5 projects, 250 scans. Max: $99 a month, 25 projects. Teams: $25 to $50 per seat per month. [2] |
| What gets tested | What a visitor sees, then, after proof, your database and APIs, read-only. No injection, no exploitation, ever. | The FAQ speaks of read-only probes. The SQL injection page describes sending payloads into fields, parameters and APIs, and the pricing page “non-destructive exploit attempts” (beta). [1][5][2] |
| Proof of ownership | Required before any active test: DNS, meta tag or file. | No: the terms say CheckVibe doesn't verify your authorization, which stays your sole responsibility. [12] |
| Supabase and Firebase | After proof: the rows the anon key can read counted without reading one, Firestore, Storage and Realtime Database tried for reads. With Supabase connected: your policies read one by one. | Supabase connected: RLS policies on every table, buckets, edge function auth. Firebase: the Realtime Database and config probed from outside. [6][7] |
| Code | GitHub, read-only, Solo and Pro: JavaScript, TypeScript, Python, PHP, Swift (iOS), Kotlin (Android). | GitHub and GitLab: rules for Next.js, Supabase and API route code, npm, Python and Ruby dependencies. [8][9][2] |
| Fixes | A prompt to paste into your agent. With Solo and Pro, Rustine also writes the fix's code (AI Fix). | A prompt for Claude Code, Cursor, Windsurf or Codex. Automatic fix pull requests on team plans. [10] |
| MCP server | A 14-day trial with Solo, full with Pro. | Yes, for Claude Desktop, Cursor, Continue, Windsurf and Codex CLI. [11] |
| Monitoring and alerts | The full audit run again every week from Solo, and an email when a newly published flaw hits one of your versions. | Daily monitoring on Pro; Slack and Microsoft Teams alerts on Max and team plans. [2] |
| Languages | French and English. | English. The site has no French version. [1] |
| Publisher, law, hosting | MBEN DEV, a French SARL. French law. The app, the API and the database in Finland (Hetzner), scans in Paris. | A sole proprietorship based in Switzerland. Swiss law, courts of Zug. Subprocessors in the United States (Vercel) and the US or EU (Supabase). [12][13] |
What CheckVibe does better today
- Much wider: site, code, pull requests, cloud, and SEO, accessibility and uptime too, in one tool. [1][4]
- More projects and scans for the money: 5 projects and 250 scans at $49 a month on Pro. [2]
- Built for teams: seats, pull request review, Slack, Teams, Jira and Linear. [2]
- Daily monitoring from Pro, and GitLab on top of GitHub. [2]
What Rustine does on top
- A quick scan with no account and no card, and a free plan that doesn't expire.
- Proof that the site is yours before any active test, and tests that stay read-only: the frame of article 323-1 of the French Criminal Code.
- iOS and Android apps: Swift and Kotlin code read on GitHub, with rules written for mobile. And PHP, WordPress and Laravel code.
- WordPress: the plugins and themes seen on your page, compared with Wordfence's known flaws.
- Everything in French, published by a French company, under French law.
Who should pick which
- CheckVibe, if you have a developer team, if you want one tool for everything (code, cloud, SEO, uptime) and Slack or Jira integrations. [2][4]
- Rustine, if you simply want to know what a stranger can read on your app, stay read-only on your live site, analyse a mobile app, or get everything in French.
Scan your site, it's free
Paste your address: the quick scan reads what a visitor sees, nothing more. The details show once you've proven the site is yours.
Free toolsSecurity headers test
Questions
Does CheckVibe check that the site is mine?
According to its terms, no: checking authorization stays your responsibility. Rustine asks for proof before any active test.
Can I use Rustine and CheckVibe together?
Yes, they don't get in each other's way. Compare what they find on your site before you choose.
Sources
- CheckVibe, Home page, read on 15/10/2026
- CheckVibe, Pricing: Solo & Team Plans, read on 15/10/2026
- CheckVibe, Free Tools: Security, SEO & AEO Scanners, read on 15/10/2026
- CheckVibe, Checks: Security, SEO & AEO, Uptime, Performance, read on 15/10/2026
- CheckVibe, SQL Injection Scanner, read on 15/10/2026
- CheckVibe, Supabase security, read on 15/10/2026
- CheckVibe, Firebase security, read on 15/10/2026
- CheckVibe, Source code (SAST), read on 15/10/2026
- CheckVibe, Dependency vulnerabilities, read on 15/10/2026
- CheckVibe, Findings shipped as prompts, read on 15/10/2026
- CheckVibe, Scan from any AI (MCP server), read on 15/10/2026
- CheckVibe, Terms of Service (v3.2, July 13, 2026), read on 15/10/2026
- CheckVibe, Subprocessors, read on 15/10/2026