Skip to content

Vibe Coding Security Index

How secure are AI-built apps really?

Aggregated, anonymous analysis of all voluntarily shared rescue scans. No URLs, no personal data — only verdict distribution, finding rate and the most common rule hits. Citable under CC-BY.

7

Scans analysed

7 %

Median finding rate

Share of applicable checks that fire on average. Counted, not weighted.

Verdict distribution

  • Go: 57 %
  • Iterate: 43 %
  • Stop: 0 %

Most common findings

RSC-ACC-006Accessibility signals unremarkable86 %
RSC-PRV-004Privacy signals unremarkable71 %
RSC-SEC-003No Content-Security-Policy71 %
RSC-SEC-023No Permissions-Policy71 %
RSC-ACC-005Accessibility law likely applicable57 %
RSC-SEC-005No clickjacking protection57 %
RSC-SEC-004MIME sniffing not disabled57 %
RSC-SEC-024No Referrer-Policy57 %
RSC-COD-002Debug leftovers in the shipped build57 %
RSC-SEC-092No CAA record43 %
RSC-DET-002Framework stack detected43 %
RSC-SEC-007Server technology disclosed43 %

By platform

unbekannt

Median finding rate: — · n=6

Dataset available openly under CC-BY. Please cite as “decivo Vibe Coding Security Index”. index.json