Free-to-use chart: security headers on vibe-coded apps

You can republish this chart and its data anywhere, including commercially. Please keep the credit line and the link back to VibeIncidents.

Share of analyzable apps whose page response did not include each security header
	Missing CSP	Missing X-Frame-Options / frame-ancestors	Missing Referrer-Policy	Missing Permissions-Policy	Missing X-Content-Type-Options
Lovable (n=25)	24 (96%)	23 (92%)	0 (0%)	24 (96%)	0 (0%)
Bolt (n=25)	24 (96%)	24 (96%)	24 (96%)	24 (96%)	23 (92%)
Replit (n=17)	17 (100%)	17 (100%)	17 (100%)	17 (100%)	17 (100%)
v0 (n=19)	19 (100%)	19 (100%)	19 (100%)	19 (100%)	19 (100%)
All (n=86)	84 (98%)	83 (97%)	60 (70%)	84 (98%)	59 (69%)

Data: VibeIncidents research, security headers on 86 public vibe-coded apps, measured Oct 15, 2026. Public, search-indexed published apps, not a random sample. 8 of 95 apps were unreachable and 1 was excluded because its robots.txt disallowed our crawler; all 9 are left out. A missing header is a hardening gap, not a breach.

Embed the live chart

<iframe src="https://vibeincidents.com/embed/headers-study-2026/chart/" title="Missing security headers on vibe-coded apps, by platform (VibeIncidents)" width="100%" height="460" style="border:0" loading="lazy"></iframe>
<p style="font-size:12px">Data: <a href="https://vibeincidents.com/research/vibe-coded-apps-security-headers-platform-defaults/" target="_blank" rel="noopener">VibeIncidents research</a>, security headers on 86 public vibe-coded apps, measured Oct 15, 2026.</p>

Or use the image

Chart of missing security headers by platform

<a href="https://vibeincidents.com/research/vibe-coded-apps-security-headers-platform-defaults/"><img src="https://vibeincidents.com/embed/headers-study-2026/chart-headers-by-platform.png" alt="Share of 86 public vibe-coded apps missing each security header, by platform" width="1200"></a>
<p style="font-size:12px">Data: <a href="https://vibeincidents.com/research/vibe-coded-apps-security-headers-platform-defaults/" target="_blank" rel="noopener">VibeIncidents research</a>, security headers on 86 public vibe-coded apps, measured Oct 15, 2026.</p>

Credit line

Data: <a href="https://vibeincidents.com/research/vibe-coded-apps-security-headers-platform-defaults/" target="_blank" rel="noopener">VibeIncidents research</a>, security headers on 86 public vibe-coded apps, measured Oct 15, 2026.