ArgosX · Field ScanN=44 · Public surface only · 2026
The polish is hiding the holes.
We scanned 44 vibe-coded web apps. On the surface they look shipped — clean pages, real copy, working flows. Then we checked the layer you can't see in a screenshot.
Average polish score
88/100
They don't look broken. Range 66–98. This is not AI slop.
Then look down
Ship a security gap
75%
33 of 44 carry a medium-or-worse security gap — visible before anyone logs in.
What's missing · Security
Basic guardrails, left off
Share of the 44 apps missing each protective HTTP header, on the public page alone. Ranked by how common the gap is.
X-Frame-OptionsmedApp can be loaded in an invisible frame — the setup for clickjacking your own users.
70%31/44
Content-Security-PolicylowNo allow-list for scripts — the biggest single lever against cross-site scripting.
68%30/44
Permissions-PolicylowNothing declaring which features (camera, mic, location) the page may use.
61%27/44
X-Content-Type-OptionslowBrowser left free to "guess" file types — an old avenue for slipping content through.
50%22/44
Referrer-PolicylowFull URLs leak to third parties in the referer header.
41%18/44
Straight from us:most of these are one-line, config-level fixes — “defense in depth,” not a live breach. The one with real teeth is X-Frame-Options: without it, clickjacking is a genuine exposure. The point isn't that any single header is a catastrophe — it's that the basics are absent at scale, and nothing in the build flow flagged it.
What's missing · Accessibility
Hard to use, invisibly
The same “looks done, isn't finished” gap shows up where it hurts real users — and, in some markets, where it carries legal exposure.
Low color contrastmedText under the minimum contrast ratio — hard to read for low-vision users.
50%22/44
Content outside landmarksmedPage regions unmarked, so screen readers can't navigate the structure.
50%22/44
Any high-severity a11y failurehighIncludes buttons with no discernible text — invisible to screen readers.
36%16/44
Contrast, high-severityhighText so low-contrast it fails the strictest threshold outright.
20%9/44
Plus the quiet traffic tax: 45% (20/44) were missing a canonical link tag, and a fifth had no sitemap or robots.txt at all — duplicate-content and crawl issues that cost you search visibility you already paid to earn.
Why this keeps happening
It's structural, not careless
Cause 01
The AI optimizes for what you can see
You asked for a signup page that works, and you got one. It looks great, so it feels done. Headers, contrast ratios, and canonical tags never render in the preview — there's no visual feedback loop telling anyone they're missing, so they stay missing.
Cause 02
The builder is a poor judge of its own work
The same model that wrote the code has no adversarial view of it. Ask if it's safe and it'll tell you yes. Testing your app with the tool that built it is grading your own homework — which is the whole reason an independent pass exists.
See what your app is missing
Same scan, your URL, about a minute. It shows exactly which of these gaps your app has — on the public page, no login required.
Scan your app free →getargosx.com · independent testing for vibe-coded apps
Methodology. 44 vibe-coded web apps, scanned by ArgosX on their public landing surface only — unauthenticated, no logged-in flows. 52 completed scan cycles across 44 distinct apps. Severity follows a fixed rubric (critical / high / med / low) assigned by deterministic checks; findings are not re-graded after the fact. Each percentage is the share of distinct apps exhibiting that finding. Figures exact as of 2026-07-29. A tool-by-tool breakdown (Lovable / Bolt / v0 / Replit) is deliberately withheld until per-tool sample sizes are large enough to compare honestly.
HighMediumLow / defense-in-depthPolish score