We scanned 780 websites. AI-built ones match the rest on every critical problem but one: more than 1 in 5 run their database from the browser

31% of AI-built sites (103 of 332) have at least one critical problem of their owner's making, against 7.8% (35 of 448) of sites built with Wix, Webflow and Shopify. Leave out the one pattern described in the next section and the figures are 9% and 7.8%: the same, within the noise of a sample this size.

"Of their owner's making" matters. Several problems our scanner rates critical are set by the platform on its free subdomains: Wix marks every wixsite.com page as not for search engines, Bolt blocks crawlers on every bolt.host site, and a canonical link pointing at the owner's own domain is correct, not a fault. Counted as the owner's problems, they made every single Wix site in the sample look critically broken - and our first draft of this article said AI-built sites were the better of the two. They are left out of every figure here.

22.6% of AI-built sites (75 of 332) ship a Supabase project address and its anonymous key in the JavaScript every visitor downloads. In the control group the figure is 0%.

That needs saying carefully, because it is easy to overstate. The anonymous key is designed to be public. It is safe if Row Level Security is switched on for every table, with a policy saying who may read and write what. If it is not, anyone who opens the browser console can read the database, and often write to it.

We did not check which of these projects have Row Level Security configured. The only way to find out is to try to read the data, and these are other people's databases. So this is not a count of leaking sites. It is a count of sites where a single setting in a dashboard decides whether their visitors' data is private - built by a tool whose users are, by design, often not developers.

None of the sites exposed a service_role key, the one that bypasses every policy. That is the mistake that would make this section alarming, and nobody in the sample made it.

Only findings that are the site owner's doing are compared here. Security headers are left out on purpose: the hosting platform sets them for every site it serves, so "97% of sites lack header X" really means "three of four platforms do not send it". With four AI platforms and three classic ones, those figures describe platforms, not people.

Bolt's sample is small; treat its row as indicative. Base44 is missing because the crawl index timed out on its domain, and Hostinger is excluded for the reason given under Method.

The control group exists to stop a study like this from blaming AI for things every small site does. It also caught a mistake of ours. On the first run, our detector labelled 68.9% of the classic-builder sites "likely AI-assisted" - 100% of Wix sites and 98% of Webflow sites.

The cause was a scoring rule. A confident match on a builder counted toward "is this AI?" whatever kind of builder it was, so the more certain the scanner was that a site was Wix, the more AI it thought the site looked. We changed it so that only AI-builder fingerprints score, re-ran every site, and the control group now comes out 0% "likely AI" and 0% "AI-built". Detection of the AI builders themselves did not move: 98.8% of the AI group is identified as AI-built.

Every number in this article is from the corrected run.

1. If it uses Supabase, open the Supabase dashboard, go to Authentication, then Policies, and check that Row Level Security is enabled on every table in the public schema, each with an explicit policy.
2. Make sure the only Supabase key in your front end is the anon key. A service_role key in browser code must be rotated today.
3. Move any paid API key (OpenAI, Resend, Stripe secret) behind a server function. If it has been in the page, rotate it.
4. Give the site a real title, a description and a main heading. The defaults are visible in every search result and link preview.

Or scan it: the scanner checks all of this and tells you which apply.

• Sample. Hostnames on each builder's own domain (*.lovable.app, *.replit.app, *.bolt.host, *.wixsite.com, *.webflow.io, *.myshopify.com) from Common Crawl collection CC-MAIN-2026-43, sampled at random with a fixed seed so the selection can be reproduced.
• Labels. Each site's builder comes from its hostname, not from our scanner, so the group a site is in does not depend on the tool that measures it.
• Who these sites are. Sites on a builder's free subdomain skew toward small and unfinished projects in both groups. The comparison is like with like; the absolute numbers would be lower for sites on custom domains.
• Hostinger excluded. hostingersite.com is the preview domain for all Hostinger hosting, not only its AI builder: 48 of the 75 sites we sampled there were WordPress. The builder cannot be read from the hostname, so the group was dropped.
• One page per site. The home page, its headers and up to three JavaScript bundles, fetched once, in 2026-10. 8 sites did not answer and are not in any percentage.
• No site is named. We publish aggregates only. A list of sites with a Supabase project in the browser would be a list of places to try, so it does not exist outside our own machine.

The aggregate numbers are available as JSON. The code that collected and counted them is open in the repository: scripts/study-harvest.js, scripts/study-run.js, scripts/study-report.js.