Not verified
First-quarter 2026 assessment of 200 apps
183 of 200 vibe-coded apps, 91.5 percent, contained at least one vulnerability traceable to AI hallucination or missing security context.
2026-04
Finding
No cookies were set on the first response
The landing response set no cookies, so there were no flags to check.
Last updated September 20, 2026
Good to know · About ten minutes
Why AI-built apps get this
Session cookies come from whatever library the agent reached for, with whatever defaults it ships. Secure, HttpOnly and SameSite are three small settings that turn a scripting bug into an account takeover when they are missing, and nothing in your app looks wrong when they are.
What it affects
The landing response set no cookies, so there were no flags to check.
What the evidence line looks like
set-cookie: session=abc; Path=/ with no HttpOnly and no SameSite
Every finding on a result carries a line like this one: the request that was made and the answer that came back. You can run the same request yourself and get the same answer, which is the point.
The fix
Nothing to change here.
Prompt for your coding agent
Keep protective flags on any cookie added later.
A result gives you this prompt written for your builder, in its own dialect, and a batch prompt that carries every fix at once.
Incidents that involved this
- Not verified
Tenzai study of AI-built apps
69 vulnerabilities across 15 apps built by five AI coding tools.
2026-02 - Not verified
Tea app, second breach
Three days after the first breach, over a million private messages were exposed through an API endpoint with no access control.
2025-07 - Not verified
Base44 authentication flaw
A platform-wide authentication flaw allowed access to private enterprise data.
2025-01
Related terms
Run the free Launch Risk Check on your app
ShipReady is not a penetration test or a security certification. No automated check can prove an application is secure.
Last updated September 20, 2026