Where AI-built apps do better
Keys and passwords written straight into the code appear in 3% of AI-built apps and 11% of the older ones. AI tools and platforms now default to environment variables, and GitHub blocks many known key formats on push. Outdated packages with known flaws are also less common (53% vs 59%), largely because AI-built apps are younger and start from current versions.
Where they do worse
The problems that grow are about who may do what: tables anyone can read (8% vs 1%), missing login checks (7% vs 2%), payment status the browser can set (3% vs 0%) and features anyone can use on the owner's bill (3% vs 0%).
These are business-logic mistakes. The code works, every line looks reasonable, and nothing breaks in a demo. They only show when someone asks "what stops a stranger from doing this?", a question AI tools rarely ask unprompted.
Why the overall number is higher for older apps
Counting any high or critical finding, 45% of the older apps are affected against 40% of AI-built ones (median score 90 vs 90). Most of that gap is old packages and old code habits. Treat the overall comparison with care; the category rows say more than the total.
Data: Redproof's automated checks on public GitHub repositories, November 2026. No repository is named. Method and limits