We're measuring what actually ships broken in AI-built apps.
This is a live index built from real SafeLaunch scans — leaked keys, open databases, exposed files, vulnerable dependencies. We publish the headline numbers once we've scanned at least 30 apps, so every figure is honest.
Leaked keys & secrets
Live API keys an attacker can lift straight from the code or browser bundle.
Database access (RLS)
Whether row-level security is on — or every user's data is readable by anyone.
Hidden / malicious code
Obfuscated or planted code slipped into config and build files.
Vulnerable dependencies
Known CVEs in the packages the app pulls in.
Live-site hardening
HTTPS, security headers, and publicly exposed .env / .git files.
Where your data goes
Which AI providers the app ships data to, and whether that's disclosed.
Add your app to the data.
Scan your app in about 30 seconds. You get the full report; the index gets one more honest data point.
Scan my appMethodology
Every number on this page comes from SafeLaunch scans of real apps built with AI tools. We read public code and public web responses only — the same things a browser can see — and never store anyone's source. Figures are aggregate and anonymized: no app, repo or owner is identified. Rates are published only once the sample passes 30 scans.