State of the Swamp: what the scans keep finding
We don't run surveys. We run scans. So instead of guessing what vibe-coded security looks like, here's what it actually looks like — pulled live from our own corpus, first-party and zero-PII.
This report runs on real scan data — and we hold it back until there's enough of it to be honest. Quoting “80% of sites” off a couple dozen scans isn't a finding, it's noise, and the whole point of this page is that the numbers are real.
We're still building the corpus. The moment it's big enough to publish percentages nobody can wave away, they'll appear here automatically — the breakdown of what's spoofable, what's leaking, and how much scores climb after a scan.
Want to move that along? The fastest way is to add your domain to the count:
Run a scan and see where you land against the rest of the swamp.
Scan your site free →