AgentDAST / Guides
On this page
Security scanners for vibe-coded apps, compared
By Tornike@realtornikeo
Apps built with Lovable, Bolt, v0, Replit, or Cursor ship fast. Deployed access breaks them first: a table anyone can read, a private page anyone can open, a key shipped to the browser. Each scanner type sees one slice. This guide compares the slices, so you can stack two or three cheap ones well.
The pattern is documented. CVE-2025-48757 records a scan of 1,645 Lovable-built apps. In 170 of them, missing or weak Supabase Row Level Security (RLS) left data readable with the public anon key. The code in those apps could look fine. The deployed rules were the problem.
The short comparison
| Option | Looks at | Best at | Misses |
|---|---|---|---|
| Supabase Security Advisor | Your database configuration | Flagging RLS and database setup problems in your project | The rest of the app, other backends, full auth flows |
| Code scanners: Semgrep, Snyk Code | Source code and dependencies | Risky code patterns, secret patterns, known package flaws | Deployed rules, environment, live access control |
| Builder built-in checks, where offered | Your project inside that builder | A fast warning while you build | An independent check of the live deployment |
| Header and TLS checkers | One page response | TLS, security headers, cookie flags | Data access, login boundaries, private records |
| AgentDAST | Your live website over HTTP | What a stranger can reach, with evidence for your agent | Source-only flaws, browser-only bugs |
1. Start with the free database check
If your app uses Supabase, run its Security Advisor first. Supabase describes Advisors as deterministic checks that flag misconfigured RLS policies and other project issues. You can run them in the dashboard, by CLI, or through an agent. It costs nothing and it is the highest-value first check for this stack. Supabase also warns that some findings may be intentional. Read each one against the access you meant to allow.
2. Add a code scan if you control the repo
Builders who export code, and teams working in Cursor or a normal editor, can add a code scanner. Tools such as Semgrep and Snyk Code read source and dependencies before deploy. They are the right layer for committed secrets, unsafe patterns, and known-vulnerable packages. Deployed database rules need a live check on top. A clean code scan opens the work. A live assessment closes it.
3. Test the deployed app like a stranger
A live test asks the question your users care about: can someone without permission reach private data? AgentDAST tests your public HTTPS deployment over HTTP. Declare your separate backend host, such as your Supabase project host, when you register the site. For a precise test, plant a synthetic flag in a private record. If the assessment retrieves that exact value, the capture is confirmed. General observations still need your review.
A stack by situation
- Lovable, Bolt, or v0 with Supabase and no local repo: Security Advisor, plus a live AgentDAST assessment. Skip code scanners you cannot run.
- Cursor or Replit with a repo you keep: code scan on each change, Security Advisor if you use Supabase, live assessment after each release.
- About to take payments or real user data: all of the above, then test two accounts by hand. Check that account B cannot read or change account A records. No scanner replaces that test.
Questions builders ask
- Can I scan an app without access to its code? Yes, for live checks. Security Advisor works in your Supabase project, and AgentDAST needs only the deployed URL plus ownership proof. Code scanners are the ones that need a repo.
- Is my Supabase anon key a secret? No. It ships in the browser by design. RLS rules are what protect the data behind it, which is why the CVE above mattered. Keep service and admin keys on the server only.
- What does a free stack cost? Nothing at this scale. Security Advisor is built into Supabase, code scanners have free editions, and AgentDAST includes 100 assessments a month. Budget your review time first. Findings pile up faster than free tiers run out.
Limits to keep in mind
AgentDAST works over HTTP on public HTTPS sites. It has no browser, so it does not confirm browser-only flaws, and a clean run does not certify your app secure. Header grades say nothing about data access. Use our AI-built website checklist for the manual steps around any scanner.
100 free assessments per month. No card required. Get a free API key.