Skip to content
ShipReady

Finding

The https address did not answer cleanly

Browsers show a warning page or refuse the connection, so most visitors never reach the app at all.

Last updated September 20, 2026

Before launch · An afternoon

Why AI-built apps get this

An AI builder gives you HTTPS on the hosted address and stops there. The moment you point your own domain at it, the redirect, the certificate and every hard-coded http:// in a copied snippet become yours. Nothing in the build warns you, because from the inside everything still works.

What it affects

Browsers show a warning page or refuse the connection, so most visitors never reach the app at all.

What the evidence line looks like

GET http://example.com returned 301 to https://example.com, certificate valid to 2026-12-01

Every finding on a result carries a line like this one: the request that was made and the answer that came back. You can run the same request yourself and get the same answer, which is the point.

The fix

Check the certificate on your hosting or domain provider, renew it if it has lapsed, and make sure the domain points at the right host.

Prompt for your coding agent

The https certificate for this app failed validation. Check it has not expired, that the domain points at the right host, and that the certificate covers this exact hostname. Renew or re-issue it through your hosting or domain provider.

A result gives you this prompt written for your builder, in its own dialect, and a batch prompt that carries every fix at once.

Incidents that involved this

  • Not verified

    First-quarter 2026 assessment of 200 apps

    183 of 200 vibe-coded apps, 91.5 percent, contained at least one vulnerability traceable to AI hallucination or missing security context.

    2026-04
    Read the incident
  • Declared

    CVE growth in AI-generated code

    CVE entries attributed to AI-generated code rose from 6 in January 2026 to more than 35 in March 2026.

    2026-03
    Read the incident
  • Observed

    5,600 vibe-coded apps scanned

    More than 2,000 vulnerabilities and more than 400 exposed secrets found across vibe-coded apps.

    2026-02
    Read the incident
  • Not verified

    Tenzai study of AI-built apps

    69 vulnerabilities across 15 apps built by five AI coding tools.

    2026-02
    Read the incident

Related terms

Run the free Launch Risk Check on your app

ShipReady is not a penetration test or a security certification. No automated check can prove an application is secure.

Last updated September 20, 2026