Most AI-built sites are already gone. A third of the rest are wide open.
We took 343 Lovable subdomains out of the public certificate logs and ran our read-only check on every one of them. 76 still answered. Of those, 11 let a stranger read rows out of the database, 78 percent of all the addresses had already disappeared, and the median site sits at a C.
267 of the 343 addresses answered nothing at all: a 404 from the builder, or no answer. That is 78 percent. Most vibe-coded projects are weekend experiments that get abandoned, and any study of this space that does not say so is counting ghosts. Everything below is about the 76 sites that were actually live.
Grades of the 76 live sites · median 76 of 100 · 8 sites with at least one critical finding
We could tell a Supabase backend was in use on 38 of the 76 live sites, because the project address and the public key ship inside the page's own JavaScript, as they are supposed to. We then asked each table the site itself references for a single row, as an anonymous visitor with that public key. On 11 sites, rows came back. That is 29 percent of the sites with a detectable database.
We never downloaded a table. We asked for one row and read the total the database reported back in its own headers. Added up, those 39 open tables reported 5,102 rows, the largest single one 2,192. On 6 sites the open table carried column names that read like personal data: email, name, phone, address.
Some of that is fine. A table of public blog posts is meant to be readable. But a table called profiles or bookings or leads is not, and the builder gives you no warning either way: Row-Level Security is simply off until someone switches it on.
Every site aimed at people in Germany needs a reachable Impressum (§ 5 DDG) and a privacy notice (Art. 13 GDPR). Of the 76 live sites, we could find an Impressum on two, and a privacy notice on ten. Fonts pulled straight from Google, which a German court has already treated as an unlawful transfer of the visitor's IP address, were on 36 percent.
| Check | Share |
|---|---|
| DE-IMP-01 No Impressum found | 97 % |
| T-09 No Permissions-Policy | 97 % |
| T-02 No Content-Security-Policy | 96 % |
| T-03 Your page can be framed | 91 % |
| DE-PRIV-01 No privacy notice found | 87 % |
| Q-09 Google sees an empty page | 68 % |
| DE-3P-01 Fonts loaded from Google | 36 % |
| DE-CK-03 Trackers without a consent tool | 14 % |
| A-01 Anyone can read your database | 14 % |
| A-07 Accounts without email confirmation | 13 % |
| A-03 Personal data is publicly readable | 8 % |
Sample: distinct *.lovable.app hostnames appearing in public certificate transparency logs, deduplicated, 343 in total. That is not a random sample of AI-built sites. It is one builder, only its free subdomains, and only the ones that ever got a public certificate. Sites on their own domain are invisible to this method, and those are the more serious projects, so the picture here probably skews towards the hobby end.
One run, on 13 September 2026, from one network location in Germany. A site that was slow or blocked our request counts as dead in these numbers, which means the dead share is an upper bound.
Every request was read-only. We fetched what any visitor fetches, plus one single row per table the site itself names in its own code, using the public key the site publishes. We never wrote, never logged in, never tried a password, and never fetched a second page of anything.
We stored no row contents, no table names, no addresses of any individual site and no evidence. What is kept from the run is the per-site grade, the check ids that fired and the counts you see above. No site is named here, and none will be named on request.
Small numbers: 11 open databases out of 38 is roughly 29 percent, but with a sample this size the honest range is somewhere between about 16 and 45 percent. Treat it as "a large minority", not as a decimal.
What this does not prove: that any specific site is insecure, that these tables hold anything sensitive, or that Lovable is worse than any other builder. We checked one builder because that is where the public addresses are. We expect to find the same defaults everywhere, and we will publish that too.
Deckproof sells a paid report, so we have an interest in these numbers looking bad. That is exactly why the method above is written out in full and why the row counts come from the databases themselves rather than from us. If you think a figure is wrong, write to us and we will correct it in public.
Your own site takes thirty seconds
Same check, same read-only method, on whatever you built. Free, no signup, and we tell you which of the above applies to you.
PASTE YOUR SITE’S ADDRESS