Free vs Pro Scan: What's the Difference?

Quick answer: SimplyScan's free scan provides a high-impact health check covering exposed secrets, frontend security headers, and Supabase misconfigurations with full remediation details. The Pro scan expands this to a comprehensive 8-dimension audit including authentication, authorization, injection, CSRF, dependencies, and AI-specific risks like prompt injection. Upgrade when handling real user data.

By Daniel A · Kraftwire Software

SimplyScan's free scan provides a high-impact health check covering exposed secrets, frontend security headers, and Supabase misconfigurations with full remediation details. The Pro scan expands this to a comprehensive 8-dimension audit including authentication, authorization, injection, CSRF, dependencies, and AI-specific risks like prompt injection. While the free tier is ideal for early-stage vibe-coded projects, Pro is designed for apps handling real user data that require monitoring and PDF reporting.

What Does SimplyScan Check for Free?

The free scan at SimplyScan is designed to be the first line of defense for developers using tools like Lovable, Bolt.new, and Cursor. It is not a "teaser" scan; it provides actionable data on the most critical vulnerabilities that lead to immediate compromise. In approximately 30 seconds, the engine analyzes your deployed application from the outside-in, requiring no source code access or signup.

1. Secrets Detection

The free scan identifies high-risk credentials accidentally bundled into your frontend code. This is a common pitfall in AI-generated apps where the LLM might suggest hardcoding a key for "simplicity" or "testing."

• AI Service Keys: Detection of OpenAI, Anthropic, and Google AI keys.
• Payment Keys: Identification of Stripe secret keys or PayPal credentials.
• Database Strings: Supabase service role keys or MongoDB connection strings.
• Cloud Credentials: AWS access keys and Google Cloud service accounts.

2. Frontend Security & Headers

This check ensures your site isn't vulnerable to basic browser-based attacks. It audits your security headers to verify the presence of:

• Content-Security-Policy (CSP): Essential for preventing XSS attacks.
• Strict-Transport-Security (HSTS): To enforce secure HTTPS connections.
• X-Frame-Options: To block clickjacking attempts.
• Cookie Security: Checking for HttpOnly, Secure, and SameSite flags to protect session data.

3. Supabase Configuration

Given that Supabase is the primary backend for many vibe-coded apps, the free scan specifically looks for:

• Exposed service role keys that bypass all security.
• Missing Row-Level Security (RLS) on public tables.
• Insecure authentication settings that could lead to account takeovers.

What Does the Pro Scan Cover?

The Pro scan is a deep-tissue audit. While the free scan looks at the "skin" of the app, Pro looks at the "organs" · the logic, the dependencies, and the architecture. It covers 8 dimensions in one pass, including speed, SEO, and accessibility. This is critical for apps that have moved beyond the MVP stage and are now processing sensitive user information or financial transactions.

4. Authentication & Authorization

Pro goes beyond checking if a login page exists. It analyzes the robustness of the auth flow:

• Brute Force Protection: Testing for rate limiting on login and password reset endpoints.
• Broken Access Control: Checking if a user can access another user's data by manipulating IDs (IDOR).
• Session Management: Verifying token expiry, secure refresh logic, and logout functionality.

5. Injection & CSRF Protection

AI-generated code often lacks proper input sanitization because LLMs prioritize functionality over security. Pro scans for:

• SQL/NoSQL Injection: Patterns where user input is concatenated directly into database queries.
• Cross-Site Request Forgery (CSRF): Ensuring state-changing actions require valid tokens or strict CORS configurations.
• Code Injection: Identifying dangerous functions like eval() used with unsanitized data.

6. AI-Specific Security (AEO & Prompt Injection)

As AI agents become more autonomous, they introduce new risks. Pro checks for:

• Prompt Injection: Patterns that could allow users to hijack the underlying LLM instructions.
• AI Visibility (AEO): Ensuring your site is indexable by AI search engines like Perplexity and ChatGPT.
• Cost Protection: Identifying missing rate limits that could lead to "wallet exhaustion" via AI API abuse.

7. Performance & Speed Optimization

Speed is not just about user experience; it is a security and revenue factor. Pro provides:

• Core Web Vitals: Lab data for LCP (Largest Contentful Paint), FID, and CLS.
• Resource Optimization: Identifying unoptimized images or render-blocking JavaScript.
• Revenue Impact: Insights into how speed improvements correlate with user retention and conversion.

8. Dependency & Infrastructure Audit

Pro audits the "hidden" code in your node_modules and your domain setup:

• Vulnerable Dependencies: Scanning for known CVEs in your npm packages.
• Domain Health: Checking SPF/DKIM/DMARC records to prevent email spoofing.
• SSL/TLS Grade: Verifying the strength of your encryption protocols and certificate validity.

Speed Equals Revenue: The Pro Advantage

One of the most requested topics from our readers is the link between performance and the bottom line. While a free scan might tell you a page is "slow," the Pro scan quantifies this. Faster apps rank better in both traditional SEO and the emerging field of Answer Engine Optimization (AEO).

For vibe-coded apps, which often rely on heavy client-side rendering (SPA), performance bottlenecks are common. SimplyScan's Pro report identifies the specific scripts or unoptimized assets that are dragging down your load times. Improving these metrics directly impacts your "vibe" · a fast, snappy app feels more professional and trustworthy to users, reducing churn and increasing the likelihood of conversion.

When Should You Upgrade to Pro?

Use the Free Scan When:

• You are in the initial "vibe-coding" phase, just seeing if an idea works.
• You want to ensure you haven't accidentally committed an OpenAI key to the frontend.
• You need a quick check of your security headers after a deployment.
• You are building a public-facing site with no sensitive user data.

Upgrade to Pro When:

• Handling User Data: If you have a users table or any PII, you need Pro to check RLS and Auth.
• Preparing for Launch: Before you share your link on X (Twitter), LinkedIn, or Product Hunt.
• Compliance Needs: If you need a professional PDF report to show partners or for GDPR/SOC2 signals.
• Preventing AI Abuse: If your app uses expensive LLM calls that need rate-limiting protection.
• Continuous Improvement: When you need scheduled rescans and uptime monitoring to ensure your app stays healthy as you add features.

Feature Comparison: Free vs. Pro

The following breakdown illustrates the depth of coverage between the two tiers.

• Core Security (Secrets, Headers): Included in Free · Deep Analysis in Pro.
• Supabase/Firebase RLS Checks: Basic in Free · Comprehensive in Pro.
• Auth & Authorization Logic: Not included in Free · Full Audit in Pro.
• Injection & CSRF Detection: Not included in Free · Full Audit in Pro.
• AI Security & Prompt Injection: Not included in Free · Full Audit in Pro.
• Performance & Speed (8 Dimensions): Not included in Free · Full Audit in Pro.
• SEO & AI Visibility (AEO): Not included in Free · Full Audit in Pro.
• Email Security (SPF/DKIM/DMARC): Not included in Free · Full Audit in Pro.
• PDF Reports: Not included in Free · Included in Pro ($14.99 one-time).
• Uptime Monitoring & Alerts: Not included in Free · Included in Pro Monitoring ($24/mo).
• Rescans: 2 Included in Free · Unlimited or Scheduled in Pro.

How the SimplyScan Engine Works

Both tiers utilize the same core engine, which simulates a real-world browser environment. This "outside-in" approach is vital because it sees exactly what an attacker sees. When you run a scan:

• Crawling: The engine loads your URL, executing all JavaScript just as a user (or attacker) would. This allows it to find secrets hidden in bundled scripts.
• Analysis: It inspects the DOM, network requests, and headers. It looks for missing security flags on cookies and insecure API calls.
• Pattern Matching: It looks for known vulnerability patterns specific to AI-built stacks. For example, it checks for common Lovable or Bolt.new misconfigurations that lead to data leaks.
• Reporting: It generates a score across 8 dimensions in approximately 30 seconds. The report includes clear remediation steps for every finding.

For those looking to integrate security into their development workflow, we also offer an MCP server for use directly within tools like Cursor, Windsurf, or VS Code. This allows you to scan your local environment before you even deploy to production.

Start Free, Scale with Pro

The goal of SimplyScan is to make security accessible to the new wave of AI developers. You should never launch an app without at least a free check. It takes 30 seconds and requires no signup. Once your "vibe" starts attracting real users, the Pro report provides the professional-grade audit necessary to protect your data and your reputation.

By choosing the right tier, you ensure that your innovation isn't derailed by preventable security flaws. Whether you are a solo developer building a weekend project or a startup founder scaling a new AI tool, SimplyScan provides the visibility you need to build with confidence.

Run a Free Scan Now · Explore Pro Monitoring

Related Guides

• Vibe Coding Security Checklist
• How to Read Your SimplyScan Report
• Supabase Security Checklist
• AI Visibility and AEO Guide