HONEST COMPARISON
The "my platform handles security" alternative for people who build with AI
Hosting and app-building platforms are genuinely good at securing what they control: TLS certificates renew themselves, DDoS is absorbed at the edge, servers get patched without you ever thinking about it. That is the bottom half of the stack. The half that actually gets apps breached - your database access rules, your API routes, the keys inside your JavaScript bundle - ships with your code. No platform can secure code it did not write.
When built-in platform security genuinely is enough
If your site is a static page - a portfolio, a landing page with no login, no database, no API routes and no user data - then your platform's defaults cover most of your real risk, and a security scanner will mostly confirm that. The equation changes the moment your app stores user data or exposes an API, because from that point on the highest-risk surface is the part only you control.
Side by side
What it protects
Built for
Feedback
Misconfiguration detection
Time to first result
Ongoing
Pricing
Last reviewed July 2026. Send corrections to [email protected].
To be clear: this is not "platforms are insecure"
The opposite. Vercel, Netlify, Lovable, Bolt and Base44 run hardened infrastructure that most teams could never match on their own, and building on them is a good security decision. The shared-responsibility split is not a flaw, it is how every serious platform works, and as of July 2026 the major platforms document it themselves: they secure the infrastructure, you secure what you deploy on it.
UNPWNED does not audit the platform - it scans what you deployed on it, from the outside, the way an attacker would see it. It cannot see inside your server-side code; it tests the live, deployed surface. If your deployment has no code of its own, you may genuinely not need us yet.
Common questions
Does Vercel or Lovable handle security for me?
Partly, and the part matters. Platforms handle transport security (TLS), network-level attacks (DDoS), and keeping their own infrastructure patched. What no platform handles is the application you built: whether your database tables have access rules, whether your API routes check authorization, whether an API key is sitting in your client bundle, whether your forms accept anything an attacker sends. That split is called the shared-responsibility model, and every major platform documents it. UNPWNED scans exactly the half that is yours.
What actually gets AI-built apps breached?
Rarely the infrastructure - almost always the application layer: exposed secrets in client-side code, database tables readable without authentication, missing security headers, permissive CORS, unprotected API routes. We publish live statistics from real scans of AI-built and human-built sites on our research page, updated continuously, so you can see the current failure rates rather than a marketing number.
My platform is SOC 2 certified. Am I covered?
The platform's SOC 2 report covers the platform's controls: their infrastructure, their processes, their people. It says nothing about whether the app you deployed there exposes an admin route or ships credentials in its JavaScript. If a customer asks whether your product is secure, the platform's certificate is one half of the answer; the state of your own deployment is the other, and that half is on you.
See it on your own site
The fastest way to settle the question is to look at your actual deployment. Free scan, findings included, upgrade only if you want the fixes.
700+ checks · under 2 minutes · no signup