The latest articles on DEV Community by Daniel G (@coachdanielg). https://dev.to/coachdanielg https://media2.dev.to/dynamic/image/width=90,height=90,fit=cover,gravity=auto,format=auto/https:%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Fuser%2Fprofile_image%2F4087513%2F1ad678ef-62f9-4ab7-b7f2-50e99efbce41.jpg https://dev.to/coachdanielg en Daniel G Wed, 26 Aug 2026 08:05:02 +0000 https://dev.to/coachdanielg/i-scanned-1219-ai-company-websites-73-failed-a-basic-security-check-4gbk https://dev.to/coachdanielg/i-scanned-1219-ai-company-websites-73-failed-a-basic-security-check-4gbk <p>I ran a free security scanner against the homepages of 1,219 AI companies. <strong>73% failed a basic check</strong> — fewer than 4 of the 8 standard security headers. One in four had <strong>zero</strong> security headers at all.</p> <h2> What I did </h2> <p>GuardScan is a single-file Python scanner — no API key, no account, no telemetry. It checks a site for the 8 standard security headers, TLS certificate validity, HTTPS redirection, and cookie flags, then returns a graded report with severity and a fix for every finding.</p> <p>I pointed it at 1,219 AI company websites and let it run.</p> <h2> The three numbers that shocked me </h2> <ul> <li> <strong>73% failed</strong> the basic check (fewer than 4 of 8 standard security headers)</li> <li> <strong>25% had zero security headers at all</strong> — not even X-Frame-Options</li> <li>Only <strong>9% had 6+ headers</strong> </li> </ul> <h2> What a security header actually does </h2> <ul> <li> <strong>Content-Security-Policy</strong> — blocks XSS by controlling what the page may load</li> <li> <strong>Strict-Transport-Security</strong> — forces HTTPS, stops downgrade / MITM interception</li> <li> <strong>X-Frame-Options</strong> — prevents clickjacking</li> <li> <strong>X-Content-Type-Options</strong> — stops MIME sniffing / stored XSS</li> <li> <strong>Referrer-Policy</strong> — stops tokens and paths leaking in the referrer</li> <li> <strong>Permissions-Policy</strong> — limits camera / mic / geolocation abuse</li> <li> <strong>Cross-Origin-Opener-Policy / Cross-Origin-Resource-Policy</strong> — isolate cross-origin interactions</li> </ul> <p>They're the first layer of defense — they block attacks before they ever reach your application code.</p> <h2> Why AI companies specifically </h2> <p>AI companies ship fast, add a chatbot on day one, and skip the boring baseline. A chatbot is a whole new attack surface — and if the headers aren't there, it's unprotected.</p> <h2> The scanner (free, open source) </h2> <div class="highlight js-code-highlight"> <pre class="highlight shell"><code>pip <span class="nb">install </span>requests python guardscan.py yoursite.com </code></pre> </div> <p>Two commands. No API key, no signup, no telemetry. Every finding comes with severity, impact, and a copy-paste fix (Nginx + generic).</p> <p>Full data and methodology: <a href="https://github.com/coachdaniel12168-eng/guardscan/blob/main/REPORT.md" rel="noopener noreferrer">https://github.com/coachdaniel12168-eng/guardscan/blob/main/REPORT.md</a></p> <p>Repo: <a href="https://github.com/coachdaniel12168-eng/guardscan" rel="noopener noreferrer">https://github.com/coachdaniel12168-eng/guardscan</a></p> <p>I'd genuinely appreciate feedback on whether the "fail" threshold (4 of 8 headers) is a fair line.</p> security webdev Daniel G Mon, 24 Aug 2026 12:50:08 +0000 https://dev.to/coachdanielg/test-1lee https://dev.to/coachdanielg/test-1lee <p>test body</p>