SniffPupHow SniffPup compares
Last checked: October 18, 2026. Every competitor detail below comes from that tool's own public pages, linked under each entry. Pages change; check them before you decide.
The short version: the biggest difference between these tools is what you hand them. Some read your live URL, some read your code, some read SQL you paste, and some read your Supabase project from the inside. SniffPup reads only your live URL, passively. That makes it quick and safe to try, and it also means it can't see your code, your server logic or your database policies. Several tools below can, and we say so.
SniffPup, in one paragraph
A free, passive scan of your live web URL (no native mobile apps). It checks for secrets in your HTML and JavaScript, public /.env, /.git, /.DS_Store and /.npmrc files, the one source map your JavaScript points to, security headers, cookie flags, HTTPS redirects and what AI crawlers can read. The free scan lists every issue by title and severity and shows full details and the fix for the most serious one; the one-time $19 Full Fix Report unlocks the rest. Plans run from $9/mo; Pro ($39/mo) adds a deep Supabase check that uses your public anon key, read-only, after you verify you own the site, and counts which of up to 30 tables an anonymous visitor can read. The free scan can't see RLS policies. See the FAQ for details.
At a glance
| Tool | What it reads |
|---|---|
| SniffPup | Your live URL, passively (Pro deep check: your public Supabase API, read-only, after ownership is verified) |
| CheckVibe | Live app, plus your GitHub repo and Supabase backend if you connect them |
| ScanVibe | Live URL (passive) |
| VibeDoctor | Your repo (public or private, read-only) plus your deployed site |
| Paste-your-SQL RLS checkers (Continuum, VibeRaven) | SQL you paste (schema dump, migrations or pg_policies output), analysed in your browser |
| Lovable's built-in security scan | Your Lovable project from the inside: database rules, dependencies and (Deep scan) all your app code |
| Supabase Security Advisor | Your Supabase project's own configuration |
SniffPup vs CheckVibe
Says it runs 100+ live-app checks plus source-code analysis (SAST), dependency and secret scans, PR reviews, cloud config, uptime monitoring and live threat detection, with an MCP server and REST API. Every plan starts with a 14-day free trial; its pricing page lists Starter at $24/mo, Pro at $49/mo and Max at $99/mo, plus per-seat Team plans.
Where CheckVibe is better: Much broader. Connecting your repo and Supabase project lets it read code and RLS policies that no outside scan can see, and it adds monitoring, threat detection and (on Team plans) PR review that SniffPup doesn't have.
Sources (checked October 18, 2026): checkvibe.dev, checkvibe.dev/pricing
SniffPup vs ScanVibe
A free, no-signup URL scan that describes itself as passive and non-intrusive. Its FAQ lists SSL/TLS, security headers, exposed keys and secrets, vulnerable JavaScript libraries, exposed files (.env, .git), Supabase RLS rules, Firebase security rules and API endpoint authentication, with an A–F score. Its FAQ says scans are free and unlimited and show everything, including fix instructions and AI prompts (the same page also labels its AI fix prompt as Pro); Pro ($9/mo) adds monitoring, badges and full history.
Where ScanVibe is better: Its FAQ says the free scan shows every check with fix instructions, where SniffPup's free scan shows full details only for the most serious one. It also lists checks SniffPup's free scan doesn't make, such as SSL certificates, vulnerable JavaScript libraries, Supabase RLS rules and Firebase security rules.
Source (checked October 18, 2026): scanvibe.dev
SniffPup vs VibeDoctor
Says it runs 149+ checks across repo and live site: secrets, auth and access, dependencies (including imports of packages that don't exist), code health, performance and SEO, and runs inside your coding agent over MCP. New accounts get a Free Week (one project, one scan a day, full report).
Where VibeDoctor is better: It reads your source code, so it can find problems that never show up on the live site, such as unprotected routes, missing rate limits and hallucinated packages, and it covers performance and code quality too.
Source (checked October 18, 2026): vibedoctor.io
SniffPup vs Paste-your-SQL RLS checkers (Continuum, VibeRaven)
Continuum's free checker runs eight checks (RLS never enabled, RLS with no policies, world-readable sensitive tables, wide-open writes, anonymous write grants and more) and gives corrected SQL. VibeRaven's free checker reads your migration files for public tables without RLS, using (true) conditions and security definer functions the anon key can call. Both say the analysis runs in your browser and nothing you paste is uploaded. VibeRaven says it reads the SQL you give it, not a live database; Continuum's checker works on what you paste and says it doesn't replace a security audit.
Where Paste-your-SQL RLS checkers is better: They read your actual policies, which SniffPup's free scan can't see at all, and they catch write-policy mistakes (like with check (true)) that SniffPup's Pro deep check, which only tests anonymous reads, does not.
Sources (checked October 18, 2026): uxcontinuum.com/tools/rls-checker, viberaven.dev/supabase-rls-checker
SniffPup vs Lovable's built-in security scan
Lovable's docs describe a Quick scan that runs automatically on publish (database access rules such as missing row-level security and rules that let everyone through, leaked-password protection, npm dependency vulnerabilities, unauthenticated MCP servers) and an on-demand Deep scan that reviews your application code for access control, injection, leaked secrets, payments and auth issues. The docs say running scans is free.
Where Lovable's built-in security scan is better: If you build on Lovable, run it first. It sees your database rules and code directly and can fix many findings for you. Lovable's own docs also say its scans don't replace a thorough security review.
Source (checked October 18, 2026): docs.lovable.dev/features/security
SniffPup vs Supabase Security Advisor
Deterministic checks built into Supabase (Studio, CLI, MCP and Management API). Security lints include RLS Disabled in Public, Permissive RLS Policy, Security Definer View, policies that reference user_metadata, and security definer functions callable by anon.
Where Supabase Security Advisor is better: It ships with Supabase and reads your real database settings and policies. If you use Supabase, open it before paying for anything. SniffPup can't see any of this from the outside.
Source (checked October 18, 2026): supabase.com/docs/guides/database/database-advisors
FAQ
Is SniffPup a replacement for Lovable's security scan or Supabase Security Advisor?
No. Those tools read your project and database from the inside. SniffPup checks your live website from the outside, the way a stranger sees it. Use them together.
Which tool should I use to check Supabase RLS?
Start with Supabase Security Advisor, or a paste-your-SQL checker if you want a second read of your policies. SniffPup's free scan can't see RLS policies. Its Pro deep check tests which tables an anonymous visitor can read, using your public anon key, after you verify you own the site.
Where does SniffPup fit?
A quick, free, passive outside check of a live URL: leaked keys in your JavaScript, public .env and .git files, the source map your JavaScript points to, security headers and what AI crawlers can read, explained in plain English. The free scan gives full details and the fix for the most serious issue; the one-time Full Fix Report adds copy-paste fix prompts for every finding.
A clean report is not a guarantee of security. Spot something out of date? Email support@sniffpup.com and we'll fix it.