The State of Vibe-Coded Web Security
A continuously updated dataset of real production websites, classified by how they were built. See what AI-built sites get wrong, then find out where yours lands.
636 scans analyzed · updated 2026-08-18 · no signup required
Security Score Distribution
All 525 sites in the dataset, scored 0 (worst) to 100 (best).
The Gaps Are Everywhere
Methodology
PopulationOne row per domain: the highest-trust eligible tier is selected first, then its latest completed scan, so rescans never inflate a statistic. Demo and internal test scans are excluded. Current population: 525 distinct production websites across 636 eligible scans.
ClassificationAI-Built means a specific builder was detected by deterministic fingerprints: hostname patterns (highest confidence) or HTML and response-header markers that survive custom domains. Modern Stack covers JS-era frameworks and hosting (Next.js, React, Vite, Vercel, Netlify) that could be either AI-assisted or hand-built. Traditional covers established platforms (WordPress, PHP, Magento, classic web servers). Sites with no reliable signal are excluded from comparisons rather than guessed.
PrivacyAggregates only. No domain names, scores, or findings of individual sites are ever published. Comparison groups under 30 sites are hidden, and per-platform security metrics require at least 20 eligible observations for that metric. Site owners can opt out of aggregate telemetry entirely.
FreshnessNumbers are recomputed from the live dataset and cached for one hour. Last generated: 2026-08-18. As the dataset grows, the numbers on this page update automatically.
Where Does Your Site Land?
Scan your site and see your score against this dataset. No signup, a couple of minutes.
Scan NowBuilding With AI?
The security checklist for vibe coders: ship fast without shipping your API keys.
Read Guide