Rustine
I'm an agencyFR

Rustine and VICE: what's the difference?

Checked on 15 October 2026 · 6 min

Contents

First things first: part of Rustine's engine is derived from VICE's open-source code, published under the MIT licence by Webba Creative Technologies. Without that open work, Rustine wouldn't exist in this form. Both are French and scan sites built with AI, but they don't quite speak to the same people.

Facts read on 15 October 2026 on VICE's site, documentation and GitHub repository, linked in the table and at the foot of the page. Plans change: check their site before you choose. Spotted a mistake? Write to hello@rustine.io and we'll fix it.

Point by point

CriterionRustineVICE (read on 15/10/2026)
What it isA hosted service: you paste your site's address, nothing to install.An open-source engine (a CLI under the MIT licence) and a hosted platform that adds history, fixes and monitoring. [4][15]
Who it's forVibecoders, freelancers and small agencies, including people who don't code.Indie builders: solo founders, freelancers and small teams shipping a product. [1]
Free plan1 project, 10 quick scans a month, 3 free fixes as a prompt. No full audit.Public light scans, 1 tracked domain, security headers and TLS. [3]
Entry paid planSolo: €19 a month, VAT included. 1 project, up to 5 addresses, 30 full audits a month.Solo: 9 euros a month, or 84 euros a year. 3 domains, 10 full or specialized scans a month. No VAT charged (small business exemption). [3][13]
Several sitesPro: €49 a month, VAT included. 10 projects.Pro: 29 euros a month, or 276 euros a year. 10 domains, unlimited full scans, white-label reports. [3]
Automatic re-checkA full audit of your proven sites, run again every week, from Solo.Audits scheduled daily, weekly or monthly, on a verified domain. [9]
AlertsAn email when a newly published flaw hits a version you use (Solo, Pro).By email and on Discord. [3][9]
FixesA prompt to paste into your agent. With Solo and Pro, Rustine also writes the fix's code (AI Fix).A prompt with the evidence, for your coding assistant. [5]
MCP serverA 14-day trial with Solo, full with Pro.No MCP server mentioned on the site or in the repository. [5][15]
CLI and CINot yet: the CLI and CI are announced, not released.Yes: open-source CLI, a CI mode that fails the build, a GitHub Action that comments on the pull request and exports SARIF. [15][5]
Project codeYour GitHub repository, read-only, Solo and Pro: JavaScript, TypeScript, React Native, Python, PHP, Swift (iOS), Kotlin (Android).A local audit of the project folder: source code, .env files, npm audit, Supabase migrations, git history. [15]
SupabaseAfter proof, the full audit counts the rows the anon key can read, without reading one. With Supabase connected: your policies read one by one, using (true) included.A dedicated module: with the project URL and the anon key, tables without RLS, permissive policies, exposed buckets and edge functions. [6]
FirebaseAfter proof: Realtime Database, Storage and Firestore tried for anonymous reads. On GitHub: rules set to if true.No Firebase module on the site; Firebase keys are spotted in the code sent to the browser. [5][15]
WordPressThe plugins and themes visible on your page, their estimated version, matched against the Wordfence vulnerability database.A WordPress module: user enumeration, XML-RPC, the default login page, public cron. [7]
Active tests and proofOnly after proof that the site is yours, read-only. No injection, no exploitation, ever.On the platform, full scans wait for a DNS (TXT) proof. The CLI's documentation doesn't mention a proof: it reminds you it is meant for authorized testing. [11][4][15]
LanguagesFrench and English: the app, the reports, the fixes.Site in English and French; documentation in English. [2][12]
Publisher, law, hostingMBEN DEV, a French SARL. French law. The app, the API and the database in Finland (Hetzner), scans in Paris.Webba Creative Technologies, a sole proprietor in Nogent-sur-Marne. French law. Site hosted by OVH, in France. [14][13]

Where Rustine's engine comes from

  • Rustine's engine started from a copy of vice-security 3.5.0, VICE's open-source engine, published under the MIT licence by Webba Creative Technologies. The copyright notice and the licence text are kept in Rustine's code and at the top of every file taken from it. [15]
  • We kept its read-only core and its passive detectors, with their tests. We rewrote in TypeScript what drives them: the scope, the proof, the score, the reports, one file per check.
  • Rustine builds on top of it: a hosted service for people who don't code, proof of ownership before any active test (article 323-1 of the French Criminal Code), fixes written for your AI agent, iOS and Android code analysis, all of it in French.
  • Thanks to VICE and its author for publishing this work as open source.

What VICE does better today

  • The code is open: you can read every rule and run the engine yourself, on your machine or in your CI, without an account. [4][15]
  • CI is ready: a GitHub Action, a comment on the pull request, SARIF export to GitHub Code Scanning. At Rustine, the CLI and CI aren't out yet. [15]
  • The entry price is lower: 9 euros a month for Solo, against €19 VAT included for Rustine's Solo. And a single full scan costs 7 euros, with no subscription. [3]
  • More sites per plan: 3 domains on Solo, where Rustine's Solo covers 1 project. [3]
  • Monitoring can run daily, and alerts also land on Discord. Rustine re-checks every week and writes by email. [9]
  • A module for AI and RAG apps: prompt injection, system instruction exposure, isolation between tenants. [8]
  • Audits can reuse a test session to reach pages reserved for signed-in members. [10]

What Rustine adds

  • Nothing to install or set up: you paste your site's address and read the result in plain French or English.
  • Active tests stay read-only, and only after proof that the site is yours: never injection nor exploitation, within article 323-1 of the French Criminal Code.
  • Firebase: Realtime Database, Storage and Firestore tried for anonymous reads after proof, and open rules spotted in your code.
  • WordPress: the plugins and themes seen on your page, matched against Wordfence's known flaws.
  • AI Fix: with Solo and Pro, Rustine writes the fix's code, not just the prompt. And an MCP server, so your agent runs a scan and reads the results itself.
  • GitHub code in Python, PHP, Swift (iOS) and Kotlin (Android), on top of JavaScript and TypeScript.

Who should pick which

  • VICE, if you code and want an open tool in your terminal and your CI, if you want authenticated scans or to test an AI app, or if your budget is tight. [4][3]
  • Rustine, if you don't want to install anything, if your app runs on Firebase or WordPress, if you want the tool to write the fix, or if you have a mobile app with no site.
  • Both have a free plan: run them on your site and compare what they find.

Scan your site, it's free

Paste your address: the quick scan reads what a visitor sees, nothing more. The details show once you've proven the site is yours.

Free toolsSecurity headers test

Questions

Is Rustine a copy of VICE?

Rustine's engine started from VICE's open-source code, as its MIT licence allows, with the copyright notice kept. The read-only core and the passive detectors come from there. The scope, the proof, the score, the fixes, the GitHub code analysis and the whole service around it were written for Rustine.

Why pay for Rustine if VICE's engine is free?

If you can run a CLI and read what it finds, VICE's free engine may be enough. Rustine is for people who want a ready service: nothing to install, proof of ownership handled, reports in French and fixes for their agent.

Are VICE and Rustine related?

No, they are two independent publishers. Rustine uses VICE's code as its MIT licence allows, and credits it.

Sources

  1. VICE, Home page, read on 15/10/2026
  2. VICE, Page d'accueil (version française), read on 15/10/2026
  3. VICE, Pricing, read on 15/10/2026
  4. VICE, Verified, scoped, evidence-first security, read on 15/10/2026
  5. VICE, Features, read on 15/10/2026
  6. VICE, Supabase Deep Scan for RLS, storage and auth, read on 15/10/2026
  7. VICE, WordPress security scanning, read on 15/10/2026
  8. VICE, AI and RAG security scanning, read on 15/10/2026
  9. VICE, Website security monitoring and alerts (documentation), read on 15/10/2026
  10. VICE, Audits (documentation), read on 15/10/2026
  11. VICE, Audit modes and responsible security scanning (documentation), read on 15/10/2026
  12. VICE, VICE Docs: Platform, CLI, and GitHub Action, read on 15/10/2026
  13. VICE, Terms of service (version of July 11, 2026), read on 15/10/2026
  14. VICE, Legal notice and publisher information, read on 15/10/2026
  15. Webba Creative Technologies, vice (GitHub repository, MIT licence, release 3.5.0), read on 15/10/2026