On this page

Comparison

VibeRaven vs Semgrep

By Ohad Krispin, founder of VibeRaven · LinkedIn

Short answer

They catch different bugs, so most teams that use one can add the other. Semgrep is a general code scanner for 30+ languages with rules you can write yourself; on our test app its public rule packs found the command injection and nothing in the database. VibeRaven is a free, open source CLI for Vercel + Supabase repos with rules for Supabase migrations and the code around them; on the same app it found RLS off, a using (true) policy, a callable security definer function, the service role key in a client file and an unsigned Stripe webhook, and missed the injection. VibeRaven is advice, not a gate, and a repository check, not a live database test.

Read the production guide

Who should pick Semgrep

Teams that want a code scanner across languages and rules of their own. Semgrep Community Edition is open source under LGPL-2.1, supports 30+ languages and reads rules written in YAML, so you can encode a mistake your team keeps making. The Semgrep AppSec Platform adds Code, Supply Chain and Secrets, and is free for up to 10 contributors and 10 private repos; Teams starts at $30 per contributor per month for Code. Semgrep also says plainly that the Community Edition "will miss many true positives" because it analyzes one function or file at a time, which its paid engine extends across files.

How to run both in CI

1
Run Semgrep with the rule packs for your languages on each pull request, and add your own rules for patterns your team has already shipped once.
Output
```
semgrep scan --config p/default --config p/secrets --config p/nextjs
```
2
In the same workflow, run VibeRaven on the Vercel + Supabase repo. It exits with code 1 when it finds a blocker, so the job fails on a table without RLS or a service role key in client code.
Terminal
```
npx -y viberaven@1.7.8 check
```
3
Treat neither as the last word. Both read files; neither signs in as a user and tries to read another user's rows. Test the access rules on a preview with two accounts before launch.

When to choose Semgrep instead

You want injection and code flaws found

On our test app Semgrep reported javascript.lang.security.detect-child-process at src/app/api/export/route.ts:4, a query string passed into exec. VibeRaven 1.7.8 has no rule for command injection.

Your stack is not Vercel + Supabase

Semgrep covers 30+ languages, from Go and Java to Python and Ruby. VibeRaven rules are written for Supabase migrations and the app code around them.

You want to write your own rules

A Semgrep rule is a short YAML pattern you keep in the repo. VibeRaven has no custom rule format; you get the rules it ships.

You need supply chain and secrets scanning

Semgrep Supply Chain checks dependencies and Semgrep Secrets scans for credentials. VibeRaven 1.7.8 has no dependency vulnerability rule.

How VibeRaven helps

SQL and Supabase: Semgrep does not list SQL among its supported languages, and its public packs we ran reported nothing in the migration. On the same app VibeRaven reported rls_disabled, rls_policy_allows_all_write and security_definer_function_executable, each with the migration file and line.
Supabase and Stripe in app code: it reported service_role_key_in_client_code for a client built from NEXT_PUBLIC_SUPABASE_SERVICE_ROLE_KEY, and unverified_stripe_webhook for a route that parses the event without constructEvent. Semgrep reported neither: the key is an env var name, not a secret string, and the webhook is valid code.
No account, login or rule setup: npx -y viberaven@1.7.8 check, about 2 seconds on our app. Its env_var_drift finding compares the code with .env.example; it cannot see Vercel settings. It is a repository check for Vercel + Supabase apps, not a live database test: it does not connect to Supabase, Vercel or Stripe, and a clean result does not prove the app is secure.

Keep Semgrep for code flaws across your languages; add the repo check for the Supabase layer of a Vercel + Supabase app.

Semgrep vs VibeRaven on the same app

Written by the maker of VibeRaven. On 2026-11-03 we ran Semgrep Community Edition 1.183.0 (semgrep scan --config p/default --config p/secrets --config p/nextjs --metrics off, no login, so 215 public rules) and VibeRaven 1.7.8 on one test app of 8 files. Semgrep with a login, Pro rules or your own rules may find more than this run did.

What each one found

Findings on the same 8 file app, 2026-11-03: Semgrep CE 1.183.0 public packs and VibeRaven 1.7.8
Issue in the test app	Semgrep CE	VibeRaven
Command injection: exec with a query string	Yes, detect-child-process	No
Raw HTML rendered from a note	No, with these packs	No
profiles table with RLS off	No	Yes, rls_disabled
Update policy using (true)	No	Yes, rls_policy_allows_all_write
Security definer function anon can call	No	Yes, security_definer_function_executable
Service role key in a client file	No	Yes, service_role_key_in_client_code
Stripe webhook with no signature check	No	Yes, unverified_stripe_webhook
Env vars missing from .env.example	No	Yes, env_var_drift; it compares the code with .env.example and cannot see Vercel settings

Feature table

Semgrep and VibeRaven, from Semgrep pricing and docs and the VibeRaven source, 2026-11-03
	Semgrep	VibeRaven
Languages	30+; SQL not listed	Supabase SQL migrations, JavaScript and TypeScript app code
Custom rules	Yes, YAML	No
Cross-file analysis	Paid platform; CE reads one file or function at a time	Reads every migration in order
Dependencies and secrets	Supply Chain and Secrets products	No dependency rule; service role key and secret file checks only
Free	CE open source; platform free up to 10 contributors	Free, MIT license, no account
Paid	Teams: Code $30, Supply Chain $30, Secrets $15 per contributor per month	None for the CLI

The real Semgrep run

Output

$ semgrep scan --config p/default --config p/secrets --config p/nextjs --metrics off
  src/app/api/export/route.ts
   javascript.lang.security.detect-child-process.detect-child-process
      4| exec(`zip -r /tmp/${name}.zip ./exports/${name}`);
Ran 215 rules on 8 files: 1 finding.

The real VibeRaven run

Output

$ npx -y viberaven@1.7.8 check
🔴 No RLS policy proof in migrations  (rls_disabled)
🔴 A policy lets anyone write every row  (rls_policy_allows_all_write)
🔴 Service role key used in client code  (service_role_key_in_client_code)
🟡 Security definer function callable by the Data API roles  (security_definer_function_executable)
🟡 Stripe webhook does not verify the signature  (unverified_stripe_webhook)
🟡 Env vars used in code but missing from .env.example  (env_var_drift)
🟡 Database queries with no row limit  (unbounded_query)
⚪ No error monitoring detected  (missing_monitoring)
Verdict: ❌ 3 blockers, 4 warnings · score 5

Sources

Browse all launch guides · Read resources · How to make and check your next change

FAQ for builders before launch

Can Semgrep check Supabase RLS policies?

Not with its official rules that we found. SQL is not in Semgrep's supported languages list, so a policy check means writing generic pattern rules yourself. The Supabase Security Advisor checks RLS on the live database, and a migration check reads the policies before they ship.

Is Semgrep free?

The Community Edition is open source (LGPL-2.1). The AppSec Platform is free for up to 10 contributors and 10 private repos with Code and Supply Chain; Teams pricing starts at $30 per contributor per month.

Should I run Semgrep and VibeRaven together?

On a Vercel + Supabase app, yes. They found different bugs on the same app, both run in CI in seconds, and both are free at small team size.

Who are the main alternatives to Semgrep?

Snyk Code, GitHub code scanning with CodeQL, and the AI reviewers in Claude Code and Codex. For the Supabase layer, the Supabase Security Advisor reads the live database.