Anonymized scan data · first edition in progress
State of vibe-coded app security
What SniffPup's passive scans find across the AI-built apps people choose to scan, in plain numbers. We only publish a figure once it rests on enough different sites to mean something, so the first edition is still filling up.
different sites scanned so far
Oct 19, 2026 to Oct 27, 2026 (New York time)
Goal: 200 sites for the first full report, and at least 50 behind every figure.
That's too few to publish any figure yet. Our Privacy Policy only allows figures based on at least 50 different sites, and a handful of sites could mislead or point to someone. So for now this page shows the count and nothing else.
What the report will measure
Each figure appears once it's based on at least 50 different sites. Until then it stays blank.
median security score (out of 100)
Half the sites scored above this and half below.
of sites had at least one critical issue
A critical issue is something an attacker could use right away, such as a live secret key in the page code.
of sites had at least one critical or high issue
High issues are serious but usually take an extra step to abuse.
of sites had no Content-Security-Policy header
This header limits which scripts a page may run, which blunts script injection.
of HTTPS sites had no HSTS header
HSTS tells browsers to always use HTTPS for the site. Counted only for sites served over HTTPS.
of sites served public source maps
Source maps let anyone read the original front-end source code.
of sites exposed a .env file or .git folder
These can hold passwords, keys and the full source history.
of sites had a critical secret key in public page code
For example a live payment or AI provider key that should only live on a server. Keys are always masked in scan results.
of sites used Supabase
Detected from the public page code.
of Supabase apps had a service_role or secret key in public page code
That key skips row level security, so it can read and change the whole database.
of sites used Firebase
Detected from the public page code.
of sites blocked at least one AI crawler in robots.txt
Blocked crawlers can't read the site to answer questions about it.
of sites had no DMARC record for their domain
Without DMARC, anyone can more easily send email that looks like it comes from the domain.
How we count
- Figures come from finished SniffPup scans run on or after Oct 19, 2026, as our Privacy Policy says. Days and months follow New York time.
- Each site counts once, using its latest scan. www and non-www count as the same site.
- We leave out our own test and monitoring scans, example and test domains, localhost and raw IP addresses, and every site whose owner opted out of scanning.
- Only totals leave our database. A figure is shown only when it's based on at least 50 different sites, and a monthly report only when there are at least 200. Counts under 5 sites are shown as "under" a percent.
- Percentages are rounded to whole numbers. Checks are added over time, so months aren't always directly comparable.
Limits
- Passive checks only. A scan reads what any visitor's browser can see: the page and its public code, response headers, a few well-known public files and the domain's public DNS records. It doesn't log in, guess passwords or try attacks.
- It can't see everything. Server code, private pages and database rules aren't visible from outside, so a site can have problems a passive scan misses, and a clean result isn't a guarantee.
- Small, self-selected sample. These are sites people chose to scan, often because they care about security or were already worried. They may be safer or riskier than AI-built apps in general.
- Not a ranking. We don't compare AI builders or hosting platforms. Most issues come from how an app was set up, not from the tool that built it. Supabase and Firebase use is detected from public page code only.
Where does your app stand?
Run a free scan of a site you own. It takes about 15 seconds.