The state of AI app security

What thousands of passive audits reveal about how AI-built software ships.

Anonymized benchmarks across every product LaunchGuard has scanned. No individual product is identifiable. How we scan →

AVG SCORE

across 4429 audits

Grade distribution

1 · 0%

1015 · 23%

2388 · 54%

902 · 20%

123 · 3%

Top security mistakes

No security.txt file published53%

Permissions-Policy header absent39%

Permissions-Policy header not observed37%

No DKIM selector found among probed selectors36%

Referrer-Policy header absent31%

X-Frame-Options header absent31%

Weakest categories

Security headers

DNS & email security

Admin interfaces & APIs

Frameworks & dependencies

API surface & documentation

Brand & domain protection

Security by hosting platform

Average Security Health Score of apps we've scanned, grouped by where they're hosted and served.

Heroku

745 scans

Netlify

7184 scans

Fly.io

7121 scans

Vercel

701172 scans

Bolt

683 scans

GitHub Pages

6826 scans

Railway

6723 scans

Render

6523 scans

Replit

635 scans

Lovable

586 scans

Security by build tool

Average Security Health Score grouped by the AI tool founders built with. Self-reported by 9 founders so far.

Hand-coded (no AI builder)

795 scans

Something else

629 scans

Remy by MindStudio

556 scans

Average score over time

2026-062026-10

40critical

3627high

9182medium

28789low

5638info

How does your product compare?

Run a free passive scan and find out in under a minute.

Run a free scan