DEV Community

Daniel G
Daniel G

Posted on

I scanned 1,219 AI company websites. 73% failed a basic security check.

#security #webdev

I ran a free security scanner against the homepages of 1,219 AI companies. 73% failed a basic check — fewer than 4 of the 8 standard security headers. One in four had zero security headers at all.

What I did

GuardScan is a single-file Python scanner — no API key, no account, no telemetry. It checks a site for the 8 standard security headers, TLS certificate validity, HTTPS redirection, and cookie flags, then returns a graded report with severity and a fix for every finding.

I pointed it at 1,219 AI company websites and let it run.

The three numbers that shocked me

  • 73% failed the basic check (fewer than 4 of 8 standard security headers)
  • 25% had zero security headers at all — not even X-Frame-Options
  • Only 9% had 6+ headers

What a security header actually does

  • Content-Security-Policy — blocks XSS by controlling what the page may load
  • Strict-Transport-Security — forces HTTPS, stops downgrade / MITM interception
  • X-Frame-Options — prevents clickjacking
  • X-Content-Type-Options — stops MIME sniffing / stored XSS
  • Referrer-Policy — stops tokens and paths leaking in the referrer
  • Permissions-Policy — limits camera / mic / geolocation abuse
  • Cross-Origin-Opener-Policy / Cross-Origin-Resource-Policy — isolate cross-origin interactions

They're the first layer of defense — they block attacks before they ever reach your application code.

Why AI companies specifically

AI companies ship fast, add a chatbot on day one, and skip the boring baseline. A chatbot is a whole new attack surface — and if the headers aren't there, it's unprotected.

The scanner (free, open source) 

pip install requests
python guardscan.py yoursite.com
Enter fullscreen mode Exit fullscreen mode

Two commands. No API key, no signup, no telemetry. Every finding comes with severity, impact, and a copy-paste fix (Nginx + generic).

Full data and methodology: https://github.com/coachdaniel12168-eng/guardscan/blob/main/REPORT.md

Repo: https://github.com/coachdaniel12168-eng/guardscan

I'd genuinely appreciate feedback on whether the "fail" threshold (4 of 8 headers) is a fair line.

Top comments (0)