State of the Swamp: what the scans keep finding
We don't run surveys. We run scans. So instead of guessing what vibe-coded security looks like, here's what it actually looks like — pulled live from our own corpus, first-party and zero-PII.
Every number here comes from the 53 domains we've scanned, counted once each at their most recent scan so a re-scan never skews the math. No estimates, no panel of “experts” — just what the passive checks found.
scored under 90 on their first scan — at least one thing worth fixing, sitting in the open.
What's wrong out there
Broken down by the thing a shakedown artist would screenshot. Each one links to how to fix it:
Spoofable email
No enforcing DMARC — anyone can forge their From address.
How to fix it →Exposed secrets
A public .env/.git file, or a live key shipped in client JavaScript.
How to fix it →Weak headers
No HSTS, or plain http:// that never upgrades to HTTPS.
How to fix it →DNSSEC off
DNS answers aren't signed, so they can be tampered with in transit.
How to fix it →Takeover risk
A subdomain points at an unclaimed service an attacker could seize.
How to fix it →TLS problem
Certificate expired, expiring soon, or on a weak protocol.
How to fix it →Does fixing it actually work?
Of the 43 domains that came back for a second look, comparing each one's first scan to its latest:
improved their score
7 up · 35 held · 1 slipped.
avg points gained
Among the domains that improved.
issues closed
Failing checks fixed across every re-scan, all-time.
came back to re-scan
Of every domain we've ever seen.
That's the whole thesis in two numbers: most of this is cheap to fix, and when people see it, they fix it.
How we count
Everything above is passive and non-intrusive — DNS lookups and public HTTP responses, nothing attacked or broken. It's first-party (our own scans, not a third-party dataset) and zero-PII: we store the domain's security facts, never who ran the scan. Each domain is counted once, at its latest result, so the numbers reflect the current state of the swamp rather than whoever scanned most often.
Want the always-live version, with running totals? It's on the State of the Swamp dashboard.
Run a scan and see where you land against the rest of the swamp.
Scan your site free →