{
  "v": 1,
  "title": "State of AI-Built App Security",
  "slug": "ai-app-security",
  "edition": "2026-10",
  "label": "October 2026",
  "number": 1,
  "first": true,
  "published": "2026-10-05",
  "window": {
    "from": "2026-10-01",
    "to": "2026-10-04"
  },
  "license": "CC BY 4.0",
  "sample": {
    "panel": {
      "n": 439,
      "listed": 517,
      "published": true
    },
    "checks": {
      "n": 0,
      "published": false
    },
    "deep": {
      "n": 0,
      "published": false
    },
    "supabase_checks": {
      "n": 0,
      "published": false
    },
    "watch": {
      "n": 0,
      "published": false
    }
  },
  "too_small": false,
  "headline": [
    {
      "key": "no_csp",
      "value": 93.4,
      "label": "ship with no Content Security Policy"
    },
    {
      "key": "median_of_7",
      "value": 3,
      "label": "median number of the seven standard protections",
      "of": 7
    },
    {
      "key": "hsts",
      "value": 89.5,
      "label": "enforce HTTPS with HSTS"
    },
    {
      "key": "supabase",
      "value": 61.7,
      "label": "name a Supabase project in the code they send"
    }
  ],
  "sections": {
    "protections": {
      "source": "panel",
      "n": 439,
      "items": [
        {
          "label": "Content Security Policy",
          "key": "csp",
          "count": 29,
          "base": 439,
          "pct": 6.6
        },
        {
          "label": "HTTPS enforced (HSTS)",
          "key": "hsts",
          "count": 393,
          "base": 439,
          "pct": 89.5
        },
        {
          "label": "Clickjacking protection",
          "key": "frame",
          "count": 41,
          "base": 439,
          "pct": 9.3
        },
        {
          "label": "No MIME sniffing",
          "key": "nosniff",
          "count": 362,
          "base": 439,
          "pct": 82.5
        },
        {
          "label": "Referrer policy",
          "key": "referrer",
          "count": 354,
          "base": 439,
          "pct": 80.6
        },
        {
          "label": "Permissions policy",
          "key": "permissions",
          "count": 27,
          "base": 439,
          "pct": 6.2
        },
        {
          "label": "Cross-origin isolation",
          "key": "coop",
          "count": 10,
          "base": 439,
          "pct": 2.3
        }
      ],
      "missing_csp": {
        "label": "No Content Security Policy",
        "count": 410,
        "base": 439,
        "pct": 93.4
      },
      "none": {
        "label": "None of the seven",
        "count": 26,
        "base": 439,
        "pct": 5.9
      },
      "median_of_7": 3,
      "bins": [
        {
          "label": "0 of 7",
          "count": 26,
          "base": 439,
          "pct": 5.9
        },
        {
          "label": "1 of 7",
          "count": 51,
          "base": 439,
          "pct": 11.6
        },
        {
          "label": "2 of 7",
          "count": 16,
          "base": 439,
          "pct": 3.6
        },
        {
          "label": "3 of 7",
          "count": 308,
          "base": 439,
          "pct": 70.2
        },
        {
          "label": "4 of 7",
          "count": 5,
          "base": 439,
          "pct": 1.1
        },
        {
          "label": "5 of 7",
          "count": 14,
          "base": 439,
          "pct": 3.2
        },
        {
          "label": "6 of 7",
          "count": 14,
          "base": 439,
          "pct": 3.2
        },
        {
          "label": "7 of 7",
          "count": 5,
          "base": 439,
          "pct": 1.1
        }
      ]
    },
    "transport": {
      "source": "panel",
      "n": 439,
      "hsts": {
        "label": "Send HSTS (HTTPS enforced)",
        "count": 393,
        "base": 439,
        "pct": 89.5
      },
      "https_upgrade": {
        "label": "Send plain http:// visits to https://",
        "count": 428,
        "base": 439,
        "pct": 97.5
      },
      "source_map": {
        "label": "Serve a public source map",
        "count": 7,
        "base": 439,
        "pct": 1.6
      }
    },
    "supabase": {
      "source": "panel",
      "n": 439,
      "uses": {
        "label": "Name a Supabase project in the code they send",
        "count": 271,
        "base": 439,
        "pct": 61.7
      }
    },
    "hosting": {
      "source": "panel",
      "n": 439,
      "items": [
        {
          "label": "Cloudflare",
          "key": "cf",
          "count": 182,
          "base": 439,
          "pct": 41.5
        },
        {
          "label": "The builder's own hosting",
          "key": "bh",
          "count": 164,
          "base": 439,
          "pct": 37.4
        },
        {
          "label": "Vercel",
          "key": "vc",
          "count": 44,
          "base": 439,
          "pct": 10
        },
        {
          "label": "Netlify",
          "key": "nf",
          "count": 17,
          "base": 439,
          "pct": 3.9
        },
        {
          "label": "Other or not detected",
          "key": "ot",
          "count": 32,
          "base": 439,
          "pct": 7.3
        }
      ]
    },
    "weight": {
      "source": "panel",
      "n": 439,
      "median_kb": 1020,
      "buckets": [
        {
          "label": "Under 250 KB",
          "count": 15,
          "base": 439,
          "pct": 3.4
        },
        {
          "label": "250 to 500 KB",
          "count": 45,
          "base": 439,
          "pct": 10.3
        },
        {
          "label": "500 KB to 1 MB",
          "count": 156,
          "base": 439,
          "pct": 35.5
        },
        {
          "label": "1 to 2 MB",
          "count": 135,
          "base": 439,
          "pct": 30.8
        },
        {
          "label": "Over 2 MB",
          "count": 88,
          "base": 439,
          "pct": 20
        }
      ]
    }
  },
  "method": {
    "panel_vantage": "outside the United States"
  }
}