Rustine or UNPWNED: which one for your app?
Contents
Both scan a site built with AI and give you something to paste into your agent. They don't aim at quite the same thing. Here is what each one does, from UNPWNED's public pages and Rustine's own code.
Facts read on 15 October 2026 on UNPWNED's public pages, linked in the table and at the foot of the page. Plans change: check their site before you choose. Spotted a mistake? Write to hello@rustine.io and we'll fix it.
Point by point
| Criterion | Rustine | UNPWNED (read on 15/10/2026) |
|---|---|---|
| Scan without an account | Yes, a read-only quick scan. Until the site is proven, you see the score and the number of problems by severity. | Yes, 149 passive checks on the home page and public metadata. [2][5] |
| Free plan | 1 project, 10 quick scans a month, 3 free fixes as a prompt. No full audit. | 2 domains, 2 scans a month on a protected domain, 1 lifetime deep scan on a verified domain. [1] |
| Entry paid plan | Solo: €19 a month, VAT included. 1 project, up to 5 addresses. | Solo: $9 a month, 1 protected domain. Prices shown in US dollars. [1] |
| Several sites | Pro: €49 a month, VAT included. 10 projects. | Studio: $29 a month, 5 domains. Scale: $49 a month, 15 domains. [1] |
| Automatic re-check | A full audit of your proven sites, run again every week, from Solo. | Weekly or monthly on Solo, every 3 days on Studio, daily on Scale. [1] |
| Alerts | An email when a newly published flaw hits a version you use (Solo, Pro). | Alerts to Slack, Discord or a webhook. A public “CVE Radar” of exploited flaws. [2] |
| Fixes | A prompt to paste into your agent. With Solo and Pro, Rustine also writes the fix's code (AI Fix). | Fix prompts for about fifteen AI tools (Claude, Cursor, Lovable, Bolt…), on paid plans. [2] |
| MCP server | A 14-day trial with Solo, full with Pro. | In “developer preview”, with a personal API key. [2] |
| GitHub code | Read-only, Solo and Pro: JavaScript, TypeScript, React Native, Python, PHP, Swift (iOS), Kotlin (Android). Code rules, secrets, dependencies. | Read-only: 49 secret formats, dependencies (package.json, requirements.txt, Gemfile, go.mod), committed config files. The page doesn't mention iOS or Android. [4] |
| Supabase | The project is spotted in your public code. After proof, the full audit counts the rows the anon key can read, without reading one. With Supabase connected: your policies read one by one, using (true) included. | No check named after Supabase. After proof, anonymous reads are tried on 19 common table names, with the site's public key. [3] |
| Firebase | After proof: Realtime Database, Storage and Firestore tried for anonymous reads. On GitHub: rules set to if true. | No check named after Firebase. After proof, anonymous reads are tried on 10 common collection names. [3] |
| WordPress | The plugins and themes visible on your page, their estimated version, matched against the Wordfence vulnerability database. | Platform fingerprinting (75 technology signatures), versions matched against the US national vulnerability database (NVD). No plugin-specific check on the page. [3][2] |
| Active testing | Only after proof, read-only. No injection, no exploitation, ever. | After proof. SQL injection and XSS “not currently enabled”, with a separate consent for each scan. [2][5] |
| Languages | French and English. | English. The site has no French version. [2] |
| Publisher and governing law | MBEN DEV, a French SARL. French law. Hosted in the European Union (Hetzner). | A sole proprietor based in Israel. Israeli law. The hosting location isn't stated in the terms. [6] |
What UNPWNED does better today
- The entry price is lower: $9 a month for Solo, against €19 VAT included for Rustine's Solo. [1]
- The free plan goes further: 2 domains, and one free deep scan on a verified domain. At Rustine, the full audit needs Solo. [1]
- Monitoring can run more often if you pay more: every 3 days on Studio, daily on Scale. Rustine re-checks every week. [1]
- Alerts land in Slack, Discord or a webhook. Rustine sends emails. [2]
- The check catalog is public and detailed, with the number of tests behind each check. [3]
What Rustine does on top
- The app, the reports and the fixes come in French, and in English.
- Supabase seen from the inside: connect your project read-only and Rustine reads your policies, including the ones that let everything through, such as using (true).
- Firebase: open rules spotted in your GitHub code, on top of the anonymous reads tried on the proven site.
- WordPress: the plugins and themes seen on your page, compared with Wordfence's known flaws.
- AI Fix: with Solo and Pro, Rustine writes the fix's code, not just the prompt.
- iOS and Android apps with no site: Swift and Kotlin code read on GitHub, with rules written for mobile.
- A French company, French law, hosting in the European Union, and the frame of article 323-1 of the French Criminal Code: no active test without proof that the site is yours.
Who should pick which
- UNPWNED, if your budget is tight, if you work in English, or if you want daily monitoring and alerts in Slack. [1][2]
- Rustine, if your app runs on Supabase or Firebase, if you want everything in French, if you want the tool to write the fix, or if you have a mobile app with no site.
- Not sure? Both have a free scan. Run them on your site and compare what they find.
Scan your site, it's free
Paste your address: the quick scan reads what a visitor sees, nothing more. The details show once you've proven the site is yours.
Free toolsSecurity headers test
Questions
Is UNPWNED cheaper than Rustine?
At entry level, yes: $9 a month for UNPWNED's Solo, €19 VAT included for Rustine's Solo (read on 15/10/2026). For several sites, compare how many domains or projects each plan includes.
Does Rustine test my site without permission?
No. Without proof that the site is yours, Rustine only reads what any visitor sees. Tests of your database and APIs come after the proof, read-only.
Can I use Rustine and UNPWNED together?
Yes. Each one asks for its own proof of ownership before going further than the public scan.
Sources
- UNPWNED, Pricing, read on 15/10/2026
- UNPWNED, Home page, read on 15/10/2026
- UNPWNED, Checks, read on 15/10/2026
- UNPWNED, GitHub Security Scanner, read on 15/10/2026
- UNPWNED, Scanning Policy (last updated October 5, 2026), read on 15/10/2026
- UNPWNED, Terms, read on 15/10/2026