PatchLabs vs URL scanners
URL scanners look at your live app from outside. PatchLabs tests a copy from the inside.
Tools such as securityscanner.dev, VAS, VibeEval, SupaExplorer and UNPWNED probe your deployed site, often with the public key that ships inside your app. They’re fast and they see your real deployment. PatchLabs never touches your database or tests your live app: it rebuilds the database from your migrations, tests every table as three people and proves the fix.
Choose a URL scanner when
You want to see what your live deployment really exposes, in seconds.
- Your code isn’t in a public repo, or your app isn’t built on Supabase
- You want headers, exposed files (
.env,.git, source maps) and keys in your shipped JavaScript checked - You changed things outside your migrations and want to test what’s actually live
- You want a first result in seconds to a couple of minutes
Choose PatchLabs when
You want every table tested, and the fix proven before it ships.
- You want every table your migrations create tested, including ones your front end never mentions
- You want a signed-in stranger tested, not only an anonymous visitor
- You want a fix proven in a lab before you deploy, rather than a re-scan after
- You’d rather nothing probed your production app at all
Outside-in vs inside-out
Two ways to find out who can read your data.
Neither is wrong. They see different things, which is why they work well together.
- Your live URL
- Read the JS bundle
- Find key and table names
- Query as anon
- Findings and fix prompt
- Re-scan after you ship
- Your public repo
- Rebuild every table
- Seed fake rows
- Query as anon and stranger
- Write migration
- Prove × 3 before you ship
The scanner flow is typical, not universal. securityscanner.dev, for example, describes pulling table names from the JS bundle and testing each with the anon key. Some scanners add authenticated or repo-based checks; see the table below.
Named tools
Five scanners, as they describe themselves.
Prices and times are what each site stated on the day we checked. Entry prices only; most have higher tiers.
| Tool | How it tests | Help with the fix | Entry price | First result, as stated |
|---|---|---|---|---|
| PatchLabs | Rebuilds the database from your repo; tests as anon, signed-in stranger and owner | Writes the fix and proves it | Free for 1 app; £19/month | Median 3.5 min to a proven fixn=20, 9 Nov 2026 |
| securityscanner.dev | Live URL, 80+ modules, including a Supabase RLS probe with the anon key | A fix file for Claude Code to apply (paid tiers) | 1 free scan; $9 a scan; $29/month | About 10 s for a quick scan |
| VAS (Vibe App Scanner) | Live URL, plus code review of a GitHub repo or ZIP | Remediation snippets and fix guides | Free one-finding preview; $29/month | Not stated |
| VibeEval | Live app; access-control and cross-account checks; findings verified by an engineer | Fix guidance; free RLS checker returns fix SQL and a verification query | $25/month, 14-day trial | Under 60 s triage; 3 to 8 min deep |
| SupaExplorer | Live URL and Chrome extension: exposed Supabase keys and readable tables | AI SQL suggestions (paid) | Free detection; $9/month; $5.99 a scan | About 30 s |
| UNPWNED | Live site: 149 checks free, up to 702 for verified owners | AI fix prompts and a before/after re-scan (paid) | Free; $9/month | About 2 min |
Last checked 10 Nov 2026 against each tool’s public site. Spotted something out of date? Tell us.
What each one sees
Different blind spots.
ScannerSees, and we don’t
- Your actual deployment, including changes made outside migrations
- Security headers, exposed files and source maps
- Keys baked into the JavaScript you shipped
- Apps on backends other than Supabase, such as Firebase
PatchLabsSees, and a typical scanner doesn’t
- Every table your migrations create, not just the ones the front end names
- What a signed-in stranger can read, using a real second test user
- Whether the fix works for all three people before you deploy it
- Keys you deleted months ago that are still in your git history
Our limit. The lab is only as complete as the migrations in your repo. If something was changed in the Supabase dashboard and never written to a migration, an outside scan can see it and we can’t. The report says what it couldn’t check.
Questions
Asked about scanners.
A scanner found nothing. Am I fine?
It means nothing it tested was readable from outside. One scanner in this list says it well in its own words: no findings is not proof of security. A table the scanner never discovered, or one only signed-in users can read, can still leak. That’s what our inside-out test covers.
Why don’t you scan the live URL too?
We chose never to test customers’ live apps or touch their databases. Every check happens on a disposable copy built from your repo, with fake rows, so no real person’s data is ever read. The one thing we do look at live is opt-in and passive: Live posture loads your public home page, like any visitor, on a domain you verify, and grades its HTTPS, certificate and security headers, the way Mozilla Observatory does. It never queries your database or tries other URLs.
Is a re-scan the same as a proof?
A re-scan tells you, after you’ve shipped, whether the outside view changed. Our proof runs before you ship: we apply the fix in the lab and check that an anonymous visitor and a signed-in stranger are denied while the owner still reads their own rows.
Sources
Where these facts come from.
- securityscanner.dev · modules, RLS probe method, fix file, pricing, quick-scan timechecked 10 Nov 2026
- VAS – Vibe App Scanner · live and code scans, free preview, pricing, “no findings is not proof of security”checked 10 Nov 2026
- VibeEval · engineer-verified findings, access-control checks, free RLS checker, pricing and timingschecked 10 Nov 2026
- SupaExplorer · URL scanner and extension, pricing, scan timechecked 10 Nov 2026
- UNPWNED · check counts, owner-verified deep scan, pricing, scan timechecked 10 Nov 2026
Independent
PatchLabs is independent and not affiliated with securityscanner.dev, VAS, VibeEval, SupaExplorer or UNPWNED. Product names are used only to identify them. Facts were checked on 10 Nov 2026 and may have changed since; we update these pages when we hear about a change.
Free check
See the proof for your own app. The first one is free.
Paste your public repo. You’ll get the leaks, the fix and the proof on one page, in a few minutes.