NordKiln vs Vibeproof
Vibeproof scans a live URL or a public GitHub repo for leaked keys, open databases and known vulnerabilities. NordKiln Scan is narrower on purpose: it logs in as two test users and checks access between them. There is also a separate product at vibeproof.dev (SEO and UX monitoring); this page is about the security scanner at vibeproof.sh.
| NordKiln Scan | Vibeproof (vibeproof.sh) | |
|---|---|---|
| Free scan | Supabase checker live; full free scan planned. | Live: keys, env files, headers, cookies, consent signals, vulnerable libraries. No signup. |
| Deeper automated scan | Launch Pass $19: logged-in A/B test, report, fix prompts, re-scan, badge. | Deep scan $39 per scan: Nuclei, testssl.sh, Nikto, git-history secrets, AI review, saved report. |
| Cross-user data leaks | The main test. Two accounts you own. | Not listed as an automated two-user login test. Their deeper RLS audit is on the paid scan. |
| Repo scanning | Not in v1. We scan the running app. | Public GitHub repos, including git history on the deep scan. |
| Best fit | Builders who need to know users cannot see each other's rows before launch. | Builders who want a wide CVE and server scan of a public URL or repo. |
Vibeproof details from vibeproof.sh as of 15 Oct 2026. Prices and checks change; confirm on their site.
Using both is reasonable
A URL scanner and a logged-in access test answer different questions. Vibeproof (or Bleek) can tell you what a stranger sees from the outside. NordKiln tells you what a signed-in customer can reach. If you only do one before launch, do the one that matches the data you store.
One email when the scanner opens, then occasional notes. Unsubscribe anytime. We use FormSubmit; your address goes to dan.nordkiln@gmail.com and is not sold.