State of AI-built app security, November 2026

Where the numbers come from

• The public panel. Live apps their makers list on a public showcase of an AI app builder. Each month we visit each listed app once, the way a browser does, and read only what any visitor receives: the response headers, the home page, the scripts and stylesheets it links, the first bytes of a source map next to the first script, and where a plain http:// visit is sent. This edition has no panel reading.
• The 7IT checks. Sites people ran through the app security check and the Supabase check, and owner-verified deep scans. Each site counts once a month. Secret keys and exposed files are counted only for sites whose owner proved the site is theirs. This edition: 2 header checks, 0 deep scans, 0 Supabase checks.
• Apps under watch. Apps watched by 7IT Guard whose owners allow counting. This edition: 0.

What we never do

• We never log in, submit a form, call an app's API or read a database. Supabase usage is counted from the project address in the public code, never from the data.
• We never look for secret keys in the code of apps whose owners did not ask us to.
• We never publish a site name, address or anything that points at a site or its owner. Small groups are folded together or left out, so no single app can be picked out. A source with too few apps in a month is not published that month.

How to read it

Each source answers a different question, so the sources are never mixed into one number. Missing headers are not the whole security picture, but they are a reliable sign that nobody has done the security pass before launch. Percentages are rounded to one decimal place. The panel was read from outside the United States, so this edition shows no speed numbers.

Window: October 5, 2026 to October 31, 2026 for the 7IT checks; the panel was read on November 1, 2026. Published November 1, 2026. License CC BY 4.0: use it with a link to this page.