Rustine or Vibe App Scanner: which one for your app?
Contents
Both speak to vibecoders who shipped an app with Lovable, Replit or Base44, and look at what a stranger can reach. They differ on proof, code and language. Here is what each one does, from Vibe App Scanner's pages and Rustine's code.
Facts read on 15 October 2026 on Vibe App Scanner's public pages, linked in the table and at the foot of the page. Plans change: check their site before you choose. Spotted a mistake? Write to hello@rustine.io and we'll fix it.
Point by point
| Criterion | Rustine | Vibe App Scanner (read on 15/10/2026) |
|---|---|---|
| Free scan | A quick scan with no account. Then 10 quick scans a month with a free account, 3 free fixes. | A free first scan with no card: the score, the issue counts, and one issue in detail. [2] |
| Entry paid plan | Solo: €19 a month, VAT included. 1 project, 30 full audits a month. | Go: $19 a month, 20 scans a month, up to 3 projects. Payments are final, no refunds. [2][11] |
| Several sites | Pro: €49 a month, VAT included. 10 projects. | Pro: $39 a month, 150 scans a month, up to 10 projects. [2] |
| Re-checks | A full audit of your proven sites, run again every week, from Solo. | Every week, on Pro, with email alerts. [6][2] |
| What gets tested | What a visitor sees, then, after proof, your database and APIs, read-only. No injection, no exploitation, ever. | Read operations only, no exploit attempts, according to the scanner page. The checks list also describes SQL injection detection “using safe detection payloads”. [3][4] |
| Proof of ownership | Required before any active test: DNS, meta tag or file. | A statement: by starting a scan, you warrant that the app is yours or that you have its owner's written permission. [9] |
| Databases | Supabase and Firebase after proof, read-only: readable rows counted without reading one. With Supabase connected: your policies read one by one. | Supabase, Firebase, Convex, MongoDB and PostgreSQL, with your public keys: what a stranger could read or write. [4][3] |
| GitHub code | Read-only, Solo and Pro: JavaScript, TypeScript, Python, PHP, Swift (iOS), Kotlin (Android). | Not yet: repository scanning is announced as “coming soon”. [2] |
| Fixes | A prompt to paste into your agent. With Solo and Pro, Rustine also writes the fix's code (AI Fix). | A fix block to paste into Claude, Cursor or Windsurf. The tool doesn't edit your code itself. [5][1] |
| MCP server | A 14-day trial with Solo, full with Pro. | Yes, to drive scans from Claude Code or Cursor. [1] |
| Reports | The report in the app, and as a PDF with Solo and Pro. | Markdown for AI agents, PDF, a share link, and a verifiable badge. [7][8] |
| Languages | French and English. | English. The site has no French version. [1] |
| Publisher, law, hosting | MBEN DEV, a French SARL. French law. The app, the API and the database in Finland (Hetzner), scans in Paris. | Silex Dev. The terms state neither the country nor the governing law; the privacy policy doesn't name the host. [9][10] |
What Vibe App Scanner does better today
- The entry price is lower: $19 a month for Go, up to 3 projects, against €19 VAT included for Rustine's Solo. [2]
- More backends covered: Convex, MongoDB and PostgreSQL on top of Supabase and Firebase. [4]
- On Pro, the scan can sign in with a test account to look for one user reaching another's data. [4]
- A public, verifiable badge, and a Markdown report made for AI agents. [8][7]
What Rustine does on top
- Proof that the site is yours before any active test, and tests that stay read-only: the frame of article 323-1 of the French Criminal Code.
- Your GitHub code read today, iOS and Android apps with no site included.
- AI Fix: with Solo and Pro, Rustine writes the fix's code, not just the prompt.
- WordPress: the plugins and themes seen on your page, compared with Wordfence's known flaws.
- A free plan that goes on after the first scan, and everything in French.
Who should pick which
- Vibe App Scanner, if your budget is tight, if your app runs on Convex or MongoDB, or if you want signed-in scans with a test account. [2][4]
- Rustine, if you want your code read too, a mobile app analysed, a fix written for you, or everything in French.
Scan your site, it's free
Paste your address: the quick scan reads what a visitor sees, nothing more. The details show once you've proven the site is yours.
Free toolsSecurity headers test
Questions
Does Vibe App Scanner check that the site is mine?
Its terms ask you to warrant that the app is yours or that you have written permission; we found no DNS or file check. Rustine asks for proof before any active test.
Can I use Rustine and Vibe App Scanner together?
Yes. Both have a free scan: run them on your site and compare what they find.
Sources
- Vibe App Scanner, Home page, read on 15/10/2026
- Vibe App Scanner, Pricing, read on 15/10/2026
- Vibe App Scanner, Scanner, read on 15/10/2026
- Vibe App Scanner, Security Checks, read on 15/10/2026
- Vibe App Scanner, AI-Ready Fixes, read on 15/10/2026
- Vibe App Scanner, Continuous protection, read on 15/10/2026
- Vibe App Scanner, Reports, read on 15/10/2026
- Vibe App Scanner, Trust badge, read on 15/10/2026
- Vibe App Scanner, Terms of Service (updated October 1, 2026), read on 15/10/2026
- Vibe App Scanner, Privacy Policy (updated October 1, 2026), read on 15/10/2026
- Vibe App Scanner, Refund Policy (updated June 23, 2026), read on 15/10/2026