First-party data
Web app security statistics 2026
We scanned 1,487 live web applications between December 2025 and July 2026. Just under half shipped with a finding rated high or critical. Here is everything we found, including how we counted it and where the numbers are weak.
Published July 27, 2026 · 1,622 completed scans across 1,487 distinct domains, submitted by 1,358 distinct accounts
had a high or critical finding
had at least one critical finding
median findings per app
apps in the sample
A number we are not putting in the headline: 96.7% of applications had at least one finding of some kind. That is true, and close to meaningless. It is dominated by low-severity missing headers that almost every site on the internet is missing. The figure worth attention is the 28.6% with something rated high or critical.
Findings by severity
12,465 findings across 1,487 domains, a median of 8 per application.
| Severity | Findings | Share |
|---|---|---|
| Critical | 478 | 3.8% |
| High | 796 | 6.4% |
| Medium | 4,760 | 38.2% |
| Low | 5,618 | 45.1% |
| Informational | 813 | 6.5% |
Most common findings, by share of apps affected
Percentages are the share of the 1,487 distinct domains in the sample. SEO and metadata checks the scanner also reports are excluded here, because they are not security findings.
Includes 405 findings recorded as high severity before this check was reclassified to medium in January 2026, normalised here to the current scale.
A further 60 domains (4.0%) carry this at informational severity. That is deliberate rather than a data artifact: apps detected as designed to run inside an iframe are downgraded, because the header would break them.
Percentage is of all domains in the sample, not of Supabase projects specifically. GraphQL is a second query surface alongside PostgREST that most projects never use and rarely secure.
What this suggests
The severity distribution is the interesting part. Low and informational findings account for the majority of everything we detect, and they are largely a story about default deployment configuration rather than about anyone doing something dangerous. Missing headers are the modal finding because almost nobody sets them.
The tail is where the risk sits. 10.0% of applications had at least one critical finding, and critical findings in this sample are rarely subtle: a database table reachable without access control, or a privileged key shipped to the browser. These do not degrade the application, which is precisely why they survive to production. Nothing in a normal development loop surfaces them.
The gap between 96.7% having something and 28.6% having something serious is the single most important number on this page, and it is the one most likely to be quoted incorrectly.
Methodology
Sample. 1,487 distinct domains, from 1,622 completed scans between December 17, 2025 to July 27, 2026. The domains were submitted by 1,358 distinct accounts, roughly 1.1 domains per account, so the sample is a broad population rather than one operator scanning a portfolio.
Deduplication. Where a domain was scanned more than once, only the most recent completed scan counts, so one frequently re-scanned site cannot move a percentage.
Exclusions. Internal background scans, failed scans, and scans that did not complete are excluded. SEO and metadata checks are excluded from the findings table.
Detection. All findings come from automated scanning of live, publicly reachable applications, using only what a normal visitor can access. No authenticated testing, no exploitation, and no access to source code.
Limitations
The sample selects itself. These are applications whose owners chose to run a security scan. That is not a random sample of the web, and it is not a random sample of AI-built apps. It plausibly skews toward developers who already suspected something was wrong.
We do not verify how an app was built. The sample skews toward small, recently launched projects and many are built with AI coding tools, but we cannot confirm that for any individual application, so we do not describe this as AI-built-app data.
Automated scanning has a floor and a ceiling. It reliably catches configuration and access-control problems visible from outside. It does not catch business-logic flaws, and it produces some false positives. These are raw detections, not triaged results.
Severity is our own scale. Severity ratings are assigned by our scanner and are not directly comparable to CVSS or to another vendor's ratings.
Severity was normalised to the current scale. The missing Content-Security-Policy check was rated high until January 2026 and medium from February onward. Because the sample spans that change, the 405 historical high-severity rows are counted as medium here, so every figure reflects one consistent scale. This matters: on the raw mixed scale the high-or-critical rate is 47.8%, and on the current scale it is 28.6%. We publish the lower, current-scale number.
Counted from findings, not summary columns. Percentages are computed from individual finding records rather than the summary counters stored on each scan, which we found drift by one to two percentage points.
Citing this data
This data is published under CC BY 4.0. Cite it as:
vas, “Web App Security Statistics 2026”, July 27, 2026. Based on 1,487 web applications scanned between December 17, 2025 to July 27, 2026. https://vibeappscanner.com/app-security-statistics
If you need a cut of the data we have not published here, ask and we will run it.
Where does your app sit in this distribution?
vas runs the same checks that produced these numbers against your live application. Your first scan is free.
Common questions
What percentage of web apps have security vulnerabilities?
Across 1,487 applications scanned between December 2025 and July 2026, 28.6% had at least one finding rated high or critical severity, and 10.0% had at least one critical finding. The median application had 8 findings of any severity. A much higher share, 96.7%, had at least one finding of any kind, but that figure is dominated by low-severity missing headers and should not be read as "almost every app is insecure".
What is the most common security problem in web applications?
Missing HTTP security headers, by a wide margin. Cross-Origin-Resource-Policy was absent on 91.8% of domains, Permissions-Policy on 80.8%, and X-Frame-Options on 65.6%. These are cheap to fix and rarely exploited on their own, but they are a reliable signal that nobody reviewed the deployment configuration.
Is this data about AI-generated apps specifically?
Not exclusively, and we are careful not to claim otherwise. The sample is every application submitted to vas for scanning, which skews heavily toward small, recently launched projects, many built with AI coding tools. We do not verify how an application was built, so we describe the sample as web applications submitted for scanning rather than as AI-built apps.
How was this data collected?
Each figure comes from automated scans of live, publicly reachable applications. Where a domain was scanned more than once, only the most recent completed scan is counted, so a heavily re-scanned site cannot skew a percentage. Internal background scans are excluded. The full methodology and the known limitations are set out on this page.
Can I cite these statistics?
Yes. Please cite them as: vas, "Web App Security Statistics 2026", July 27, 2026, based on 1,487 applications scanned between December 2025 and July 2026. A link to this page is appreciated. If you need a cut of the data we have not published, get in touch.
Snapshot taken July 27, 2026. Figures are frozen at publication so citations stay accurate.