The short answer on vibe coding testing tools: the market splits into three distinct categories, security scanners ($5-$19 one-time), one-shot functional QA services ($75-$130 one-time), and ongoing AI or hybrid platforms ($29/mo and up). No single tool covers all three layers, and every tool in the SERP right now omits pricing. This page covers what each category actually does, what it costs, and where each one stops.
What do vibe coding testing tools actually test?
The category name covers three different jobs. Security scanners check for exposed API keys, missing database RLS rules, and auth flaws. Functional QA tools run user journeys (signup, login, checkout) in a real browser. Human QA adds judgment for assumption gaps that neither category of automated tool catches. Conflating these three is the most common mistake in every other roundup.
According to Hostinger (April 2026, citing Apiiro and Veracode), AI-generated pull requests contain 1.7x more issues than human-written code, with logic and correctness problems up 75%. A separate finding from the same source: 45% of AI-generated code samples fail security benchmarks across OWASP Top-10 categories. Those two numbers describe two different failure modes that need two different tools.
The breakdown matters because a security scanner will not tell you that your checkout flow fails when a coupon is applied on mobile Safari, and a functional test runner will not catch that your Supabase tables have no Row Level Security. CVE-2025-48757 (June 2025, CVSS 9.3) is the clearest case study: a security researcher found 303 insecure endpoints across 170 Lovable-built sites because Lovable's code generation did not enforce RLS, leaving anon keys that allowed direct table dumps without login. A Playwright test would not have caught it. A security scanner would have.
What are the free and DIY options for testing vibe-coded apps?
Free testing for vibe-coded apps covers two tools: the Prufa free audit (real-browser, no signup, rate-limited per IP) and Playwright (open source, Apache 2.0, $0 tool cost). VibeEval also has a free no-login tier for security probes. The realistic cost of DIY Playwright is not the tool itself but the engineering time to write and maintain tests.
Prufa's free tier runs six graded sections and produces a shareable HTML/JSON report. It checks your public pages in a real browser, which means it catches broken analytics, missing canonical tags, and basic functional failures. Per Prufa's own "State of Launch QA 2026" study (July 2026, 63 product launches audited), 38 of 49 Show HN submissions had a critical finding on day one. Broken or absent analytics was the single most common bug. Two sites had canonical tags pointing to competitor domains. The free audit catches both of those.
For Playwright specifically: Microsoft now recommends the Playwright CLI over the MCP server for coding agents (as of 2026), noting the CLI uses 4x fewer tokens per session. Playwright 1.59 added Screencast and browser.bind() for easier debugging. The tool is excellent. The honest constraint is that 63% of vibe coding users are non-developers (Hostinger, April 2026, citing Stack Overflow and GitHub Octoverse). That group cannot write Playwright tests and should not start there.
What do one-shot QA scans cover for $5 to $130?
One-shot tools and services let you buy a single audit without an ongoing subscription. The four verified options as of July 2026 are Vibe App Scanner ($5-$19), VibeDoctor (INR pricing, roughly $6-$24 at current exchange rates), VibeEval ($19/mo with a free tier, or $199 lifetime), and QAnalyz ($75-$130 for human-reviewed website tests).
Each has a different scope:
| Tool | Entry price (July 2026) | Scope | What it misses |
|---|---|---|---|
| Vibe App Scanner | $5 Starter / $19 Deep Scan | Security only: exposed secrets, Supabase RLS, auth flaws, missing security headers, SQL injection, exposed .env files (150+ patterns) | All functional QA, UX flows, user journeys |
| VibeDoctor | ~$6 Launch Audit (Rs.499 at ~84 INR/USD) | 129+ checks: security, dependency CVEs, business-logic bugs, performance, uptime, SSL | Human judgment, assumption gaps, UX edge cases |
| VibeEval | Free tier / $19/mo Pro | Security testing: broken access controls, exposed API keys, auth bypasses (310+ security probes). Works with Lovable, Cursor, Bolt, v0, Replit | Functional QA, user journeys, UX |
| QAnalyz | $75 (5-10 pages) / $130 (11-20 pages) | Human-run QA service: PDF report with annotated screenshots, cross-browser, mobile, performance add-ons (+$30 each) | AI automation, continuous monitoring (separate SaaS contracts) |
Sources: vibeappscanner.com (checked July 19, 2026); vibedoctor.io/pricing (checked July 19, 2026); vibe-eval.com (checked July 19, 2026); qanalyz.com/pricing (checked July 19, 2026).
QAnalyz is worth calling out separately because it is a human-run service delivering annotated screenshots, not an AI scanner. The $75 entry price buys a real person reviewing 5-10 pages and producing a PDF. It does not market to vibe coders specifically, but it qualifies as the most affordable human-reviewed one-shot option in this list. QAnalyz claims 1,600+ completed projects on their site as of July 2026.
For Lovable apps specifically, Vibe App Scanner and VibeEval are the most directly relevant: both check for the Supabase RLS failure mode that produced CVE-2025-48757. If you built on Lovable, the Lovable testing playbook covers the specific flows to verify before enabling RLS and what to test after.
What do AI-automated testing platforms offer from $29/mo?
Ongoing automated testing platforms differ from one-shot scans in that they persist: you point them at your site, set up flows, and get alerts when something breaks. The main option with published pricing starting at $29/mo is Prufa, which tests signup, login, and checkout flows in a real browser.
Prufa's Starter plan is $29/mo (500 runs/month, 3 sites, daily reruns, Slack and email alerts). Pro is $99/mo (5,000 runs, 10 sites, money-flow monitoring with credential-backed flows, MCP access). Team is $179/mo (50,000 runs, unlimited sites, 5 seats). Source: prufa.dev/pricing, checked July 19, 2026.
Prufa is a functional QA tool, not a security scanner. It tests signup, login, and checkout flows in a real browser. That makes it complementary to Vibe App Scanner or VibeEval, not a replacement. The free tier (no signup, rate-limited per IP) is a reasonable first step before committing to a plan.
For other AI-automated tools in the broader market: testRigor, Mabl, and Scout QA appear consistently in SERP competitors for this keyword. Scout QA's directory listing confirms a freemium model but does not publish pricing. testRigor pricing is not published (G2 reviewer estimates suggest roughly $900-$1,000/mo for Pro; treat that as unconfirmed). These are worth evaluating, but the lack of published pricing makes line-item comparison impossible here.
Why do you need both security scanning and functional testing?
Security scanners and functional testers measure different failure modes; neither substitutes for the other. Security scanners check what your app exposes at rest (API keys, database rules, headers). Functional testers check whether your app behaves correctly under use (login, checkout, analytics). You need both because the bugs each category finds, the other will not.
The inverse is equally true: CVE-2025-48757 exposed 170 Lovable-built sites because the apps had no RLS on their Supabase tables. A Playwright test running the happy path would not have caught it. A security scanner specifically checking for missing RLS would have.
The practical consequence: for a vibe-coded app launching with real user data, the minimum viable QA layer is one security scanner run before launch plus one functional tool that verifies your core user journeys. One-shot options cover both for under $30 combined. Ongoing coverage requires a subscription.
If you built on Bolt.new, the Bolt testing playbook walks the exact sequence: environment variable verification, RLS check, Stripe webhook validation, and the specific Bolt deploy failures that do not surface in the WebContainer preview.
What do AI testing tools miss?
Automated tools miss assumption gaps: bugs a founder does not know to test because they designed the feature and cannot see the app as a stranger. Per Prufa's 2026 audit, 100% of 63 launches shipped at least one machine-verified issue, and the hardest-to-catch bugs were not scanner findings but flows the founder never ran.
AI functional tools run the flows they are told to run. If you did not write a test for "what happens when a new user signs up with an email that already exists," the tool does not run it. A human tester who has never seen your app finds that edge case in the first ten minutes. That is what customer language in this space consistently describes as "the bug my first user found" and "they aren't me, they don't share my assumptions."
The what is hybrid QA page covers how to think about adding a human verification layer once AI-only automation reveals its limits.
Comparison table: vibe coding testing tools by price, scope, and what they miss
Seven vibe coding testing tools compared by price, type, scope, and gaps as of July 2026. No single tool covers all three layers (security, functional, human judgment). The right choice depends on what layer you are missing, not which tool has the most checks or the best landing page.
| Tool | Price (July 2026) | Type | Scope | What it misses |
|---|---|---|---|---|
| Vibe App Scanner | $5 / $19 one-time, $29/mo ongoing | Security scanner | Exposed secrets, Supabase RLS, auth flaws, SQL injection | All functional QA, user journeys |
| VibeDoctor | ~$6-$24/mo (INR, ~84 INR/USD) | Security + CVE + performance | 129+ checks, dependency CVEs, business logic | Human judgment, UX edge cases |
| VibeEval | Free / $19/mo / $199 lifetime | Security scanner | 310+ security probes, broken access controls | Functional QA, user journeys |
| QAnalyz | $75-$130 one-time | Human-run QA service | PDF report, annotated screenshots, cross-browser | AI automation, ongoing monitoring |
| Prufa | Free / $29-$179/mo | AI functional runner | Signup, login, checkout flows in real browser | Security scanning, assumption gaps |
| Playwright | Free (open source) | DIY functional testing | Whatever you write tests for | Everything you did not write a test for |
| Simz | $300/mo Sandbox | Hybrid QA (AI + human) | 150 AI tests + 200 human-verified test passes/mo | n/a for this category (see pricing) |
Sources: all prices verified from vendor sites on July 19, 2026. Prufa pricing from prufa.dev/pricing. QAnalyz from qanalyz.com/pricing. Vibe App Scanner from vibeappscanner.com. VibeDoctor from vibedoctor.io/pricing. VibeEval from vibe-eval.com. Simz from simz.run/pricing.
Which tool fits which stage of a vibe-coded app?
The right vibe coding testing tool changes by stage. At launch, a $0-$5 security scan catches the CVE-2025-48757 class of bug. In your first 30 days with real users, add a functional runner for daily reruns. At scale, assumption gaps cost more than subscriptions, and a hybrid QA layer is the right model.
Just launched (this week): Run one security scanner (Vibe App Scanner $5 or VibeEval free tier) plus the Prufa free audit. Total cost: $0-$5. This catches the class of bug that the CVE-2025-48757 disclosure found in 10% of Lovable apps and the broken-analytics failure that Prufa found in the majority of Show HN launches.
Getting first users (first 30 days): Add an ongoing functional runner. Prufa Starter at $29/mo gives you daily reruns with Slack alerts so you know the moment a checkout flow breaks for a real user. Consider a human-reviewed one-shot via QAnalyz ($75-$130) if you have not had a fresh set of eyes on the full user journey yet.
Scaling with a team: At this stage, assumption gaps become expensive. A hybrid QA subscription (AI tests that run on every deploy plus human testers who verify the flows AI assumes are correct) is the right model. AI-only tools generate 1.7x more issues than human-written code per Hostinger's April 2026 analysis; you need a human to tell you whether a passing test is testing the right thing.
For platform-specific checklists: the Replit testing playbook covers Autoscale cold-start failures, Deployment Secrets panel gaps, and the OAuth redirect issue that appears only after you go from .replit.app to a custom domain. The v0 testing playbook covers mock data left in production, NEXT_PUBLIC_ prefix errors, and React hydration mismatches.
The 5 free test runs on the Simz waitlist cover the most common assumption gaps that none of the tools in this table check for: the flows a real user finds in the first session that the founder never ran because they built the app.