SniffPupSniffPup vs ScanVibe
Last checked: October 19, 2026. Everything we say about ScanVibe comes from its own public pages, fetched that day and linked below. Pages change, so check them before you decide. Spot something out of date? Email support@sniffpup.com and we'll fix it.
ScanVibe and SniffPup are close cousins: both take the URL of an app built with Lovable, Bolt, Cursor or another AI tool, look at it passively from the outside, and hand you fixes you can paste back into your AI tool. Here is what each does, honestly.
What ScanVibe does well
- A genuinely generous free tier. Its pricing page lists unlimited scans, all security analyzers, full check results, fix instructions and an AI fix prompt on the free plan, with no signup.
- It's fast and friendly: results in about 15 seconds, written for people who aren't security engineers, with a fix prompt to paste into Lovable, Cursor or Bolt.
- It covers checks that matter for AI-built apps, including SSL/TLS certificates, vulnerable JavaScript libraries, Supabase RLS rules and Firebase security rules.
- It scales up nicely: Pro ($9/mo) adds scheduled scans, email alerts and PDF reports, and Business ($29/mo) adds multi-page scans, a CI/CD API with a score threshold and Slack/Discord webhooks.
In ScanVibe's own words
“Free · No signup required · Results in 15s”
scanvibe.dev/en, fetched October 19, 2026
“Yes. Scans are completely free and unlimited. You see everything: score, grade, all checks, fix instructions, and AI prompts. Pro ($9/mo) adds monitoring, badges, and full history.”
scanvibe.dev/en, fetched October 19, 2026
“ScanVibe performs passive, non-intrusive analysis only.”
scanvibe.dev/en, fetched October 19, 2026
“Business is for teams and CI/CD pipelines. You get multi-page scanning, API tokens for automation, Slack/Discord webhooks, white-label PDF reports, and everything in Pro.”
scanvibe.dev/en/pricing, fetched October 19, 2026
What SniffPup offers
- SniffPup checks the JavaScript source map your bundle points to, which can expose your original source code, plus /.DS_Store and /.npmrc alongside /.env and /.git.
- SniffPup includes a crawler view: what a browser sees versus what GPTBot sees in your raw HTML, whether robots.txt blocks AI crawlers, and whether you have an llms.txt.
- SniffPup publishes its exact 0–100 scoring formula (start at 100, subtract 40 per critical, 20 per high, 8 per medium, 3 per low) so you can check any score by hand.
- SniffPup offers a one-time $19 Full Fix Report (every finding, fix prompts for Lovable, Cursor, Bolt and Claude Code, and 30 days of re-scans) for people who don't want a subscription.
- On Pro, after you verify you own the domain, SniffPup runs a read-only deep Supabase check with your public anon key that counts which of up to 30 tables an anonymous visitor can read (row counts only, never row data) and which storage buckets are public.
Side by side
| SniffPup | ScanVibe | |
|---|---|---|
| What it reads | Your live URL, passively (about 40 requests or fewer) | Your live URL, passively (per its homepage) |
| Free scan | Lists every issue by title and severity, with full details and the fix for the most serious one. No account needed; email is optional. | Unlimited scans with all checks, fix instructions and AI fix prompt, no signup (per its pricing page) |
| Score | 0–100 from a published formula; no letter grades | Score plus an A–F grade (per its homepage) |
| Supabase | Flags service_role/sb_secret keys in the frontend; Pro deep check counts anon-readable tables after ownership verification | Lists Supabase RLS rules among its checks |
| Paid options | Free scan; one-time $19 Full Fix Report (every finding plus 30 days of re-scans, no subscription); Solo $9/mo, Starter $19/mo, Pro $39/mo. | Pro $9/mo (monitoring, alerts, PDF, badge, history); Business $29/mo (multi-page, CI/CD API, webhooks, white-label PDF) |
When to use ScanVibe instead
- You want every check's full details and a fix prompt for free, and you'll scan often. ScanVibe's free plan is built for that.
- You want SSL certificate checks, vulnerable JavaScript library checks or Firebase rule checks in the same scan.
- You want scans wired into CI/CD with a score threshold, or Slack/Discord alerts (ScanVibe Business).
When SniffPup fits
- You want to know whether your source map is public or what AI crawlers can read on your site, along with the usual secrets, files and headers.
- You want a fix for every finding without a subscription: the one-time $19 report.
- You're on Supabase and want to see, from the outside and with your ownership verified, which tables an anonymous visitor can actually read (Pro).
FAQ
Is ScanVibe or SniffPup better?
They overlap a lot and both scan a live URL passively. ScanVibe's free plan shows every check with fixes and adds SSL, JavaScript library and Firebase rule checks; SniffPup includes source-map and AI-crawler checks, a published scoring formula and a one-time $19 report. Both have free scans, so you can try each on your own site.
Can I use ScanVibe and SniffPup together?
Yes. Both are passive and read only what your site shows any visitor, so running both on your own site gives you a second opinion at no cost.
Does a clean result from either tool mean my app is secure?
No. An outside scan can't see your source code, server logic or anything behind a login. Treat a clean result as "no common mistakes found from the outside", not a guarantee.
Sources (fetched October 19, 2026): scanvibe.dev/en, scanvibe.dev/en/pricing. SniffPup details: how the scanner works, how scoring works, pricing.
A clean report is not a guarantee of security.