Website Security for DIY and AI-Built Sites
Short answer: a website built with an AI tool or a drag-and-drop builder can be secure, but it is not secure by default. Independent studies in 2025 found security flaws in 45% of AI-generated coding tasks and exposed databases or secrets across thousands of published AI-built apps. The failures repeat: no access rules on the database, API keys shipped to the browser, admin pages with no login, forms that accept anything. A 10-point check, below, catches most of them in an hour.
Figures below are from the sources linked, checked 17 October 2026.
Are AI-built websites secure?
The published evidence says the code works but the security often does not.
- Veracode's 2025 GenAI Code Security Report, released 30 July 2025, tested more than 100 large language models on 80 coding tasks. The models introduced a vulnerability from the OWASP Top 10 in 45% of tasks. For cross-site scripting the failure rate was 86%. Larger models did not do better.
- Escape.tech's scan of vibe-coded apps covered over 5,600 public applications and found more than 2,000 vulnerabilities, over 400 exposed secrets and 175 instances of personal data, including phone numbers, emails and bank account numbers.
Two reasons this happens:
- The tool optimises for a working screen. A page that lists records looks the same whether the database is locked down or open.
- The person prompting cannot see what is missing. A missing access rule produces no error, only an open door.
Builders such as Wix or Squarespace run the servers, so server-side flaws are theirs to fix. What remains yours: passwords, shared logins, third-party apps and anything pasted into a custom code block.
Which mistakes appear most in AI-generated code?
The same handful, in roughly this order:
| Mistake | What it looks like | Why it happens |
|---|---|---|
| Missing access control | Any visitor can read or edit any row in the database | Rules are opt-in per table; the AI builds the screen, not the rule |
| Exposed secrets | API keys, database passwords or payment keys inside front-end JavaScript | The AI puts the key where the call is made, which is the browser |
| Unprotected admin routes | /admin or /dashboard loads without a login | Authentication was added to the home page flow only |
| No server-side validation | Forms accept scripts, 10 MB strings or negative prices | Validation was written in the browser, which an attacker skips |
| Cross-site scripting | User text rendered as HTML | 86% failure rate in Veracode's tests |
| Verbose errors | Stack traces and file paths shown to visitors | Debug mode left on in production |
| No rate limits | One script submits 10,000 forms or guesses 10,000 passwords | Not asked for, so not built |
| Outdated packages | Dependencies with published vulnerabilities | Nobody runs updates after launch |
Broken access control has been the top category in the OWASP Top 10 since the 2021 edition and remains first in OWASP Top 10:2025. It is the one to check first.
How do I check for exposed keys and open databases?
Run these 10 checks on the live site. None needs a developer account.
- View source. Right-click, View Page Source, then search for key, secret, token, password, sk_, pk_ and api.
- Open the Network tab in browser developer tools, reload, and read the request URLs and headers. Any key sent from the browser is public. Public keys are fine; secret keys are not.
- Visit admin paths while logged out: /admin, /dashboard, /api, /login, /wp-admin, /.env, /config. Each should return a login page or a 404, never data.
- Call the data endpoint directly. If the Network tab shows a request to a database or API URL, open it in a new private window. If it returns records, the table is open.
- Change an ID in the URL. If /invoice/1042 is yours, try /invoice/1041. Seeing another customer's record is a broken access control.
- Submit the form with script tags such as a bold tag in the name field. If it renders as formatting on a thank-you page or in an admin list, input is not escaped.
- Submit the form 20 times in a minute. If all 20 arrive, there is no rate limit.
- Trigger an error. Add a stray character to a URL parameter. A plain error page is good; a stack trace with file paths is not.
- Check HTTPS and headers. Load the site at http:// and confirm it redirects to https://. Run the domain through a header scanner for Content-Security-Policy, Strict-Transport-Security and X-Frame-Options.
- List every third-party script. Each one can read the page, including form fields. Remove the ones nobody can name a reason for.
Anything found in checks 1 to 5 is urgent: rotate the key, close the table, add the login, then check whether it was used.
How do I protect forms from spam and abuse?
A public form is an API that anyone on the internet can call. Protect it in layers:
- Server-side validation. Check types, lengths and required fields on the server. Reject anything over the limits.
- Honeypot field. A hidden field that humans never fill. Submissions with it filled are dropped.
- Rate limiting. Cap submissions per IP address per minute at the server or edge.
- A challenge. Cloudflare Turnstile is free for up to 20 widgets with 10 hostnames each. Google's reCAPTCHA includes 10,000 assessments a month free, then a US$8 flat fee up to 100,000.
- Store, then notify. Write every submission to your own database first and email second. Spam is then a filter, not a lost lead. See own your website leads.
- Escape output. Anything a visitor typed is shown as text, never as HTML, in admin screens and emails.
Abuse is not only spam. Limit upload file types and sizes, and never put visitor text into an email subject or recipient field.
Who is liable under the PDPA if a DIY site leaks data?
The organisation that collected the data. The PDPC's protection obligation requires reasonable security arrangements to protect personal data in an organisation's possession or control. The tool that generated the code is not the data controller; the business is.
What changed in 2022: maximum financial penalties rose on 1 October 2022 to S$1 million, or 10% of annual Singapore turnover for organisations with turnover above S$10 million, whichever is higher, per Allen & Gledhill's summary.
A leak also triggers the breach assessment and notification duties: assess within 30 days, notify the PDPC within 3 calendar days of deciding a breach is notifiable, and notify affected individuals where significant harm is likely. The full list is in the PDPA checklist for a business website.
"Reasonable" scales with the data. A newsletter form holds emails. A booking form may hold NRIC numbers, addresses and health details, and needs the 10 checks passed before it goes live.
When should a developer review the site?
Book a review at these points:
- Before launch, if the site collects any personal data or takes payment.
- After any change to login, database rules, payment or file upload.
- When a tool adds a feature by itself, such as an AI builder regenerating a page that includes a form.
- Once a year after that, with a dependency update at the same time.
- Immediately if any of checks 1 to 5 above finds something.
Scope it in writing: access rules on every table, secrets, authentication on every private route, validation on every input, headers, dependencies, and a findings list with severity. Estimate half a day to 2 days for a small business site.
If the review finds the same class of problem across the site, the better fix is often a rebuild on a stack where these controls are standard.
What cense does
cense builds sites in Next.js on the client's own Vercel or Google Cloud account, with HTTPS, security headers, in-house forms that write to the client's database and no plugins. The client owns the domain, code, hosting and data. A free SEO report is sent on WhatsApp within 2 working days via free website analysis.
Are AI-built websites secure?+
Not by default. Veracode's July 2025 study found AI models introduced security flaws in 45% of 80 coding tasks across more than 100 models. Escape.tech scanned 5,600 vibe-coded apps and found over 2,000 vulnerabilities and 400 exposed secrets.
What is the most common security mistake in AI-generated sites?+
Missing access control: a database table or API route that any visitor can read or write because no rule restricts it. Exposed API keys in front-end code are the second.
How do I check if my site exposes an API key?+
Open the site, view the page source and the network requests in browser developer tools, and search for strings like key, secret, token and sk_. Anything that reaches the browser is public.
How do I stop form spam on a DIY site?+
Add a honeypot field, rate-limit submissions per IP, validate on the server, and use a challenge such as Cloudflare Turnstile, which is free for up to 20 widgets.
Who is liable under the PDPA if a DIY website leaks customer data?+
The organisation that collected the data. The PDPA's protection obligation sits with the business, not the tool. Maximum penalties are S$1 million, or 10% of Singapore turnover above S$10 million.
When should a developer review an AI-built site?+
Before it collects any personal data or takes payment, after any change to authentication or database rules, and once a year after that.
