ArgosX · Field ScanPublic surface only · 2026

The polish is hiding the holes.

We scanned hundreds of vibe-coded web apps. On the surface they look shipped: clean pages, real copy, working flows. Then we checked the layer you can't see in a screenshot.

Average polish score

88/100

They don't look broken. Range 66–98. This is not AI slop.

Then look down

Missing a basic safeguard

75%

3 in 4 ship with a basic security control missing, visible before anyone logs in.

First · the honest part

The scary headlines are mostly wrong

You have seen the panic: “AI-built apps are leaking everyone's data.” Mostly, they are not. A leaked database or a secret key shipped to the browser is real, but rare, low single digits, not the majority. (Cross-user access needs a login to even detect, so a free public scan cannot honestly put a number on it, and we don't.)

Here is the part that should get your attention. Most AI-built apps are not catastrophically insecure, but that does not mean they are secure. Basic security controls are missing from a wide majority of them, sitting in plain sight before anyone logs in. You do not need to be breached to have a problem. You just need to have shipped without anyone checking.

What's missing · Security

Basic guardrails, left off

Share of apps missing each protective HTTP header, on the public page alone (fixed July cohort, n=44). Ranked by how common the gap is.

X-Frame-OptionsmedApp can be loaded in an invisible frame, the setup for clickjacking your own users.

70%31/44

Content-Security-PolicylowNo allow-list for scripts, the biggest single lever against cross-site scripting.

68%30/44

Permissions-PolicylowNothing declaring which features (camera, mic, location) the page may use.

61%27/44

X-Content-Type-OptionslowBrowser left free to "guess" file types, an old avenue for slipping content through.

50%22/44

Referrer-PolicylowFull URLs leak to third parties in the referer header.

41%18/44

Straight from us: most of these are one-line, config-level fixes: “defense in depth,” not a live breach. The one with real teeth is X-Frame-Options: without it, clickjacking is a genuine exposure. The point isn't that any single header is a catastrophe, it's that the basics are absent at scale, and nothing in the build flow flagged it.

What's missing · Accessibility

Hard to use, invisibly

The same “looks done, isn't finished” gap shows up where it hurts real users, and, in some markets, where it carries legal exposure.

Low color contrastmedText under the minimum contrast ratio, hard to read for low-vision users.

50%22/44

Content outside landmarksmedPage regions unmarked, so screen readers can't navigate the structure.

50%22/44

Any high-severity a11y failurehighIncludes buttons with no discernible text, invisible to screen readers.

36%16/44

Contrast, high-severityhighText so low-contrast it fails the strictest threshold outright.

20%9/44

Plus the quiet traffic tax: 45% (20/44) were missing a canonical link tag, and a fifth had no sitemap or robots.txt at all: duplicate-content and crawl issues that cost you search visibility you already paid to earn.

Why this keeps happening

It's structural, not careless

Cause 01

The AI optimizes for what you can see

You asked for a signup page that works, and you got one. It looks great, so it feels done. Headers, contrast ratios, and canonical tags never render in the preview, there's no visual feedback loop telling anyone they're missing, so they stay missing.

Cause 02

The builder is a poor judge of its own work

The same model that wrote the code has no adversarial view of it. Ask if it's safe and it'll tell you yes. Testing your app with the tool that built it is grading your own homework, which is the whole reason an independent pass exists.

Cause 03

And it comes back after you fix it

These gaps are not a one-time cleanup. The next prompt that refactors your routing or “simplifies” a data query can reopen a hole you already closed, and nothing tells you. That is why a scan result has a shelf life, and why the check has to run again on every change rather than once before launch.

See what your app is missing

Same scan, your URL, about a minute. It shows exactly which of these gaps your app has, on the public page, no login required.

Scan your app free →

getargosx.com · independent testing for vibe-coded apps

Methodology. 578 vibe-coded web apps tested by ArgosX on their public landing surface only, unauthenticated, no logged-in flows. Per-check percentages are based on a fixed July 2026 cohort of 44 apps, drawn from the broader set tested through September 2026. The catastrophic-issue rates cited above (leaked databases, exposed secrets) are low single digits across the set; cross-user access needs a login to detect, so a public scan does not report a rate for it. Severity follows a fixed rubric (critical / high / med / low) assigned by deterministic checks; findings are not re-graded after the fact. Each percentage is the share of distinct apps exhibiting that finding. A tool-by-tool breakdown (Lovable / Bolt / v0 / Replit) is deliberately withheld until per-tool sample sizes are large enough to compare honestly.

HighMediumLow / defense-in-depthPolish score