- A study scanned 1,868 public repositories built with AI coding tools, finding 23% pass the 80-point production-ready bar and 24% have at least one critical security finding.
- The scanner's false-positive rate for critical findings was audited at 42%, then reduced to ~25% after fixing specific detection bugs, such as misidentifying placeholder secrets and permissive database policies.
- Common issues include missing Content Security Policy (90%), no privacy policy (88%), oversized files (74%), and no error boundaries (60%), highlighting the gap between AI-built demos and production-ready apps.
- Per-tool results show a narrow range of critical findings (21–31%), with earlier reported wide spreads attributed to false positives unevenly distributed across tools.
- The dataset over-represents hobby projects and demos, as serious production apps are often private, so results are not generalizable to all AI-built apps.
- The scanner uses static pattern analysis with a capped download; it cannot assess runtime behavior, deployment, or data flow, and the audit acknowledges remaining limitations.