Every week a founder ships an app built with Lovable, Bolt, Cursor, or v0, gets told "you should run a security scan," googles the phrase, and lands in a market built for enterprise security teams. This is a plain-language comparison of the eight realistic options, what each one actually catches, and where each one is blind.
The short version: security tools for AI-built apps fall into three layers. Code scanners (Semgrep, Snyk, GitHub code scanning, SonarQube) read your source and cost $0 to about $40 per developer per month. Outside-in scanners (OWASP ZAP, config-level scans) probe the running app and range from free to a few hundred dollars. Human-led audits run $300 to $2,000 for a scoped review and $5,000 to $30,000 for a full penetration test. The most common real-world failure in AI-built apps, an exposed database, is only visible to the second and third layers.
That last claim is not a guess. In July 2026 we scanned 66 live AI-built apps: 48.5% used Supabase, 40.6% of those had at least one database table readable by an anonymous request, and 15.6% exposed clearly sensitive data (user records, messages, bookings). Every one of those apps would pass a source-code scan, because nothing was wrong with the code. The database configuration was the hole.
Which security tools should you compare?
| Tool | Type | What it catches | 2026 pricing (list) | Best for |
|---|---|---|---|---|
| Semgrep | SAST (code) | Insecure code patterns, some framework misuse | Free up to 10 contributors; paid from ~$40/contributor/mo | Teams who want fast, tunable code scanning |
| Snyk | SCA + SAST | Vulnerable dependencies, known CVEs, code issues | Free tier; Team from ~$25/dev/mo | Dependency risk, which AI codegen accumulates fast |
| GitHub code scanning (CodeQL) + secret protection | SAST + secrets | Deep code analysis, leaked keys in repos | Free on public repos; ~$30/committer/mo code security, ~$19 secret protection on private repos | Teams already living in GitHub |
| SonarQube / SonarQube Cloud | Code quality + SAST | Bugs, code smells, some vulnerabilities | Free for open source; paid from ~$30/mo | Quality gates in CI more than security depth |
| Aikido | All-in-one platform | SCA, SAST, cloud config, secrets, DAST-lite | Free tier; team plans from a few hundred $/mo | Small teams wanting one dashboard instead of five tools |
| OWASP ZAP | DAST (running app) | Missing headers, injection, exposed endpoints | Free, open source | Anyone; steepest learning curve here |
| Config-level scan (e.g. Continuum Leak Check / Ship Check) | Outside-in config | Exposed database tables, leaked anon keys, RLS gaps | Free quick scan; $299 full audit | AI-built apps on Supabase/Firebase-style backends |
| Manual pentest / human audit | Human | Business-logic flaws, tenant isolation, chained exploits | $5,000-$30,000 (full pentest); $300-$2,000 (scoped review) | Pre-launch of anything handling money or PII |
Prices are vendor list prices as of mid-2026 and change often; treat them as ballpark, not gospel.
Disclosure: Continuum (this site) makes the config-level scanner in row 7. The rest of this page still recommends running other vendors' tools, because no single layer covers you, ours included.
What do code scanners (SAST) actually catch in AI-generated code?
Real things, cheaply. Run against typical AI-generated codebases, Semgrep and Snyk reliably flag:
- Hardcoded secrets: API keys and service tokens pasted into client code. AI assistants do this constantly because the founder pasted the key into the chat.
- Vulnerable dependencies: AI tools pin whatever package versions were common in training data. A fresh Lovable or Bolt project can start life with dependencies that are already months behind on security patches.
- Classic injection patterns: string-concatenated SQL, unsanitized HTML rendering,
evalon user input.
This layer is cheap enough that there is no excuse to skip it: Semgrep Community and Snyk's free tier cover a solo founder's repo at zero cost, and GitHub's secret scanning is free even on private repos (push protection for private repos falls under the paid secret protection product, about $19 per committer).
What this layer structurally cannot see: anything that lives outside the repository. Which brings us to the actual killer.
Why do most AI-built app breaches happen outside the code?
Because the popular AI app builders all sit on backend-as-a-service platforms, mostly Supabase, and the security model of those platforms lives in database policy configuration, not application code. The client ships with a public "anon key" by design; the only thing standing between the internet and your tables is row-level security done right on every table.
AI builders get the happy path right and the boundaries wrong. The numbers from our 66-app scan:
- 48.5% of live AI-built apps we sampled ran on Supabase.
- 40.6% of those Supabase apps had at least one table that returned rows to an unauthenticated request carrying only the public anon key.
- 15.6% exposed clearly sensitive tables: user records, private messages, bookings, support threads.
A SAST tool scores these apps clean. The query code is fine. The policy that should scope the query is missing, wrong, or bypassed by a SECURITY DEFINER function, and none of that is in the repo a scanner reads. This is why an outside-in check, anything that asks "what does the live database return to a stranger", belongs in every AI-built app's toolchain. You can do it by hand with curl and your anon key, with ZAP, or with a purpose-built scan like our free Leak Check; the method matters less than actually doing it against the running app.
When is a human audit worth paying for?
Automated layers catch pattern-shaped problems. Three categories are structurally judgment-bound, and auto-scanners miss all of them:
- Tenant isolation logic. "User A in company A can see company B's invoices" requires knowing what your business model intends, which no scanner does.
- Auth flow edge cases. Password reset token reuse, session state after refresh, OAuth account-linking confusion.
- Chained exploits. Three low-severity findings that combine into one account takeover.
The market for human review is wide: a scoped review of a small AI-built app runs a few hundred to about $2,000 (Continuum's Ship Check is $299 and each finding ships with a re-runnable proof; comparable scoped reviews from independent consultants run $500 to $2,000), while a full manual penetration test from a security firm runs $5,000 to $30,000 and is the right call once you handle payments, health data, or enterprise customers who will ask for the report.
What is a reasonable security stack for a vibe-coded app?
For a typical AI-built SaaS at launch, this stack costs $0 to $299 total and covers all three layers:
- Free SAST + secrets: Semgrep Community or Snyk free tier on the repo, GitHub secret scanning on.
- Free outside-in check: verify what your live database returns to an unauthenticated request, by hand or with a free scanner.
- One scoped human review before real users arrive: $300 to $2,000 depending on provider.
- After launch: dependency alerts on (free via GitHub Dependabot), and re-run the outside-in check after every schema change, because RLS regressions ship silently.
Skip step 2 and you are in the 40.6%. It is the cheapest step on the list and the one the standard tooling advice never mentions.
If you want the outside-in layer done for you, start with the free Leak Check, and if it finds something, the $299 Ship Check turns it into a ranked, proof-backed fix list. Either way, run something. The scan takes 20 seconds and losing a customer database takes considerably longer to live down.