First-quarter 2026 assessment of 200 apps
183 of 200 vibe-coded apps, 91.5 percent, contained at least one vulnerability traceable to AI hallucination or missing security context.
Finding
The public registry record says {domain} expires on {expiry}, which is {days} days away. An expired domain takes the app, the mail, and the sign in links with it.
Before launch · About ten minutes
A domain is bought once, in a hurry, on a card that later expires. The registration sits quietly for a year and then takes the app, the mail and every sign in link with it on a date nobody has written down.
The public registry record says {domain} expires on {expiry}, which is {days} days away. An expired domain takes the app, the mail, and the sign in links with it.
the public registry record gives an expiry date of 2026-10-30, 46 days away
Every finding on a result carries a line like this one: the request that was made and the answer that came back. You can run the same request yourself and get the same answer, which is the point.
Renew the domain and turn on automatic renewal with a card that does not expire before the domain does.
Prompt for your coding agent
Renew the domain registration and turn on automatic renewal at the registrar.
A result gives you this prompt written for your builder, in its own dialect, and a batch prompt that carries every fix at once.
183 of 200 vibe-coded apps, 91.5 percent, contained at least one vulnerability traceable to AI hallucination or missing security context.
CVE entries attributed to AI-generated code rose from 6 in January 2026 to more than 35 in March 2026.
More than 2,000 vulnerabilities and more than 400 exposed secrets found across vibe-coded apps.
69 vulnerabilities across 15 apps built by five AI coding tools.
Run the free Launch Risk Check on your app
ShipReady is not a penetration test or a security certification. No automated check can prove an application is secure.
Last updated September 20, 2026