The app runs on a shared platform domain

A domain is bought once, in a hurry, on a card that later expires. The registration sits quietly for a year and then takes the app, the mail and every sign in link with it on a date nobody has written down.

{domain} belongs to the hosting platform, so there is no registration of yours to expire and no registry record to read.

the public registry record gives an expiry date of 2026-10-30, 46 days away

Every finding on a result carries a line like this one: the request that was made and the answer that came back. You can run the same request yourself and get the same answer, which is the point.

Nothing to change here. A domain of your own becomes worth checking once you connect one.

A result gives you this prompt written for your builder, in its own dialect, and a batch prompt that carries every fix at once.

• Not verified

  First-quarter 2026 assessment of 200 apps

  183 of 200 vibe-coded apps, 91.5 percent, contained at least one vulnerability traceable to AI hallucination or missing security context.

  2026-04

  Read the incident
• Declared

  CVE growth in AI-generated code

  CVE entries attributed to AI-generated code rose from 6 in January 2026 to more than 35 in March 2026.

  2026-03

  Read the incident
• Observed

  5,600 vibe-coded apps scanned

  More than 2,000 vulnerabilities and more than 400 exposed secrets found across vibe-coded apps.

  2026-02

  Read the incident
• Not verified

  Tenzai study of AI-built apps

  69 vulnerabilities across 15 apps built by five AI coding tools.

  2026-02

  Read the incident

• domain expiry
• observed
• evidence