We measured the public security posture of 6,289 launched web apps. 76% ship without a Content-Security-Policy.

We run a directory of launched software (web apps, SaaS, AI tools) and every listing gets the same deterministic 7-frame benchmark. No LLM in the scoring path, public surface only: the headers and policies a browser sees before you ever sign in.

Across 6,289 launched products, here is the security baseline as measured on August 4, 2026:

76% ship with no Content-Security-Policy. CSP is the browser's front line against injected scripts (XSS).

39% have no Strict-Transport-Security header, leaving a window for protocol-downgrade attacks.

35% have no schema.org markup, which makes them invisible to AI answer engines and rich search results.

We measured the public security posture of 6,289 launched web apps. 76% ship without a Content-Security-Policy.

Related reading

I scanned 15 public Lovable apps. 40% load their database in the browser.

We scanned 10 well-known sites with our security tool. Here's what we found.

What is Content Security Policy (CSP)?

I Benchmarked 17 ESLint Security Plugins. Only One Found Every Vulnerability.

The 8-item security checklist no one tells indie devs

A Production Security Checklist