We Scanned 64 Sites Built with AI Coding Tools for Security — Here's What We Found

What we did

We sourced 70 publicly deployed sites from showcase galleries and community forums — madewithlovable.com (31 sites), madewithbolt.com (24 sites), Replit customer showcase & community (9 sites). Only live, publicly accessible sites were included. No staging environments, no localhost, no password-protected pages. 6 sites were unreachable at scan time.

Each site was scanned with AppVet's security audit, which checks:

• Security headers — HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy
• TLS — HTTPS enabled, HTTP-to-HTTPS redirect
• Cookies — HttpOnly, Secure, SameSite flags
• CORS — wildcard or reflective Access-Control-Allow-Origin
• Sensitive file exposure — .env, .git, wp-admin, server-status, and other common paths

No site owners were contacted. No sites are named individually — we report only aggregate data and anonymized patterns.

What AI coding tools get wrong

1. Security headers are the biggest gap

AI coding tools are excellent at generating application code — routes, components, API handlers. But they don't configure the server. The result: sites ship without the security headers that browsers rely on to protect users.

The most commonly missing headers we expect to find:

• Content-Security-Policy (CSP) — without it, any XSS vulnerability is fully exploitable
• Strict-Transport-Security (HSTS) — without it, downgrade attacks can steal session cookies
• Referrer-Policy — without it, sensitive URL parameters leak to third parties

This isn't a criticism of the AI tools — configuring headers is a deployment concern, not an application concern. But the gap matters because most vibe coders deploy to production with the default settings and never think about headers. See our guide: Top 5 Security Headers Every Site Needs.

2. The score gap is about hosting, not code

The most interesting finding: Bolt sites averaged 81/100 while Lovable sites averaged 74/100. That's not because Bolt writes more secure code — it's because Bolt deploys to Netlify, which adds some security headers by default. Lovable deploys to lovable.app or custom domains where headers depend on configuration.

The lesson: your hosting platform matters as much as your code. A site with perfect application code but no CSP header is still vulnerable to XSS.

3. The D-grade sites share a pattern

The 5 sites that scored D+ (58-59) all had the same profile: missing HSTS, missing CSP, missing Referrer-Policy, and at least one cookie without proper flags. These are all fixable in under 5 minutes with a single middleware or hosting config change.

4. Nobody is checking for exposed files

We probed common sensitive paths — /.env, /.git/config, /wp-admin — on every site. Most returned 404 (good). But the fact that these paths are never explicitly blocked means one misconfigured deploy could expose secrets. AI tools don't generate .htaccess rules or server block lists.

What AI coding tools get right

It's not all bad. 29 of 64 sites scored A- or higher. The common thread:

• HTTPS everywhere — every single site used HTTPS. Deployment platforms (Vercel, Netlify, lovable.app) handle this automatically.
• No sensitive files exposed — most sites properly returned 404 for probed paths like /.env and /.git
• CORS properly restricted — no wildcard or reflective CORS policies found in the majority of sites
• Some platforms add headers — Netlify (used by Bolt) adds X-Frame-Options and X-Content-Type-Options by default

The pattern: anything the hosting platform handles is fine. Anything the developer (or AI) needs to explicitly configure — CSP, HSTS, Referrer-Policy — is where the gaps appear.

How to fix it (in 5 minutes)

Here's the irony: the same AI that created these issues can fix them. The workflow:

1. Scan your site — run npx appvet scan your-site.com --types security (CLI docs) or paste your URL at appvet.dev
2. Copy the Fix with AI prompt — AppVet generates a ready-to-use prompt listing every missing header, insecure cookie, and exposed path — with the exact fix for each
3. Paste into the AI tool that built your site — Lovable, Bolt, Replit, Cursor, Claude Code. The AI reads the structured prompt and adds the missing headers in one pass.
4. Rescan — verify the fixes worked. Adding security headers typically jumps a site from B- to A+.

The Fix with AI prompt now includes a "Do Not Change" section — things your site already does right — so the AI doesn't accidentally break working configurations while fixing the issues.

The bottom line

AI coding tools are incredible for shipping fast. But "deployed" and "production-ready" are different things. The gap isn't in the AI's ability — it's in what the AI is asked to do. Nobody prompts "add HSTS and CSP headers" or "set HttpOnly on all cookies."

The average score of 77/100 isn't terrible — but it means most AI-built sites ship with 3-5 missing security protections that take minutes to add. The fix is simple: scan before you ship.

This was just the security audit. AppVet also scans for performance, accessibility, and SEO — 84 checks total across 8 scan profiles. We'll publish those results in a follow-up post.

That's what AppVet is for.