I scanned 596 websites in 2 months. 81.6% had no rate limiting. Here is what else is broken in 2026.

Two months ago I shipped UNPWNED, a passive web security scanner aimed at indie hackers and developers shipping AI-generated code (Cursor, Lovable, Bolt, Replit, v0). I had a hypothesis: small-team apps, especially anything coded with AI assistance, would have terrible security hygiene. Not because the developers are lazy, but because nobody is checking. There is no security review when you ship at 2am from your bedroom. Two months in, 548 developers ran 1,317 scans through it across 596 distinc