Rustine or VibeEval: which one for your app?
Contents
VibeEval tests your live app in depth, with attacking agents and a researcher who reviews the results. Rustine first reads what a visitor sees, and only tests your database once you've proven the site is yours, read-only. Here is what each one does, from VibeEval's pages and Rustine's code.
Facts read on 15 October 2026 on VibeEval's public pages, linked in the table and at the foot of the page. Plans change: check their site before you choose. Spotted a mistake? Write to hello@rustine.io and we'll fix it.
Point by point
| Criterion | Rustine | VibeEval (read on 15/10/2026) |
|---|---|---|
| Free scan | Yes, a read-only quick scan, no card. Then 10 quick scans a month with a free account. | A 14-day Pro trial with no card. Without an active plan, scans can't be run. [2] |
| Prices | Solo €19, Pro €49 a month, VAT included. | Pro $25 a month ($49 crossed out), Team $75 a month, Lifetime $249 once. In US dollars. [1] |
| Volume | Solo: 30 full audits a month, 1 project, up to 5 addresses. Pro: 10 projects. | Pro and Lifetime: 100 scans a month, 50 targets, 1 seat. [2] |
| What gets tested | What a visitor sees, then, after proof, your database and APIs, read-only. No injection, no exploitation, ever. | A dynamic scanner: the default profile runs injection tests and fuzzing; agents labelled “aggressive” look for SQLi, XSS and command injection. A passive mode is an option. The terms speak of non-destructive, read-only techniques. [3][4][11] |
| Proof of ownership | Required before any active test: DNS, meta tag or file. | No DNS or file proof: rules on the target addresses and an abuse review. [5] |
| Review | Automatic: each issue comes with the request that proves it, which you can replay. | Every scan on a paid plan goes through a security researcher. [3] |
| GitHub code | Read-only, Solo and Pro: JavaScript, TypeScript, Python, PHP, Swift (iOS), Kotlin (Android). | No, VibeEval has no repository access. [6] |
| Supabase and Firebase | After proof: the rows the anon key can read counted without reading one, Firestore, Storage and Realtime Database tried for reads. With Supabase connected: your policies read one by one. | Supabase tables reachable without RLS; Supabase and Firebase keys among the secrets it detects. [6] |
| Fixes | A prompt to paste into your agent. With Solo and Pro, Rustine also writes the fix's code (AI Fix). | A “Copy for LLM” button to paste into Claude Code, Cursor or Lovable. [7] |
| Alerts | An email when a newly published flaw hits a version you use (Solo, Pro). | Email and webhooks. Slack isn't available yet. [9] |
| Reports | The report in the app, and as a PDF with Solo and Pro. | Six export formats per scan, twelve compliance framework presets (ISO 27001, SOC 2, NIS2…). [8] |
| Languages | French and English. | English, Portuguese, German, Spanish. No French version. [1] |
| Publisher, law, hosting | MBEN DEV, a French SARL. French law. The app, the API and the database in Finland (Hetzner), scans in Paris. | Metaheuristic. Ukrainian law, courts of Kyiv. Data processed in Ukraine and elsewhere; scans run in the United States (Modal). [11][12] |
What VibeEval does better today
- A human reviews: every scan on a paid plan goes through a security researcher before it reaches you. [3]
- Scans can sign in to your app (token, cookie, form) and test pages reserved for members. [3]
- Reports follow twelve compliance frameworks, ISO 27001, SOC 2 and NIS2 among them, in six formats. [8]
- A lot of volume for the price: 100 scans and 50 targets a month on Pro, at $25, or a lifetime deal at $249. [1][2]
- Webhooks to send results elsewhere, and a badge to show on your site. [9][10]
What Rustine does on top
- A free scan with no account, and a free plan that lasts.
- Proof that the site is yours before any active test, and tests that stay read-only: the frame of article 323-1 of the French Criminal Code.
- Your GitHub code read on top of the site, iOS and Android apps with no site included.
- WordPress: the plugins and themes seen on your page, compared with Wordfence's known flaws.
- AI Fix: with Solo and Pro, Rustine writes the fix's code, not just the prompt.
- Everything in French, published by a French company, under French law.
Who should pick which
- VibeEval, if you want deep attack tests reviewed by a human, signed-in scans, or reports for a compliance audit. [3][8]
- Rustine, if you want to start for free, stay read-only on your live site, have your GitHub code read, or get everything in French.
Scan your site, it's free
Paste your address: the quick scan reads what a visitor sees, nothing more. The details show once you've proven the site is yours.
Free toolsSecurity headers test
Questions
Can VibeEval scan a site that isn't mine?
Its documentation says it asks for no DNS record nor verification file, and relies on address rules and an abuse review. Rustine asks for proof before any active test.
Can I use Rustine and VibeEval together?
Yes. Rustine for the ongoing read of your site and code, VibeEval for a deeper attack test when you need one.
Sources
- VibeEval, Home page (pricing), read on 15/10/2026
- VibeEval, Plans, Billing & Limits, read on 15/10/2026
- VibeEval, Running Scans: Profiles & Statuses, read on 15/10/2026
- VibeEval, AI Security Agents, read on 15/10/2026
- VibeEval, Targets: Adding URLs & Scope Rules, read on 15/10/2026
- VibeEval, Security Checks Coverage, read on 15/10/2026
- VibeEval, Getting started, read on 15/10/2026
- VibeEval, Reports & Exports: PDF, JSON, CSV, read on 15/10/2026
- VibeEval, Webhooks & Email Notifications, read on 15/10/2026
- VibeEval, Trust Badge for Your Site, read on 15/10/2026
- VibeEval, Terms of Service, read on 15/10/2026
- VibeEval, Trust (effective May 11, 2026), read on 15/10/2026