Application Security Statistics 2026

Application security statistics describe measured samples, not the whole software ecosystem. This page summarizes three AppSec Santa studies conducted in February 2026.

I analyzed 522 final AI-code samples, 7,510 returned HTTP responses, and GitHub data for 64 open-source AppSec repositories. Each section links to the full methodology and limitations.

Key statistics at a glance#

AI-generated code security#

I collected six outputs for each of 89 coding prompts, then excluded two prompts from the final analysis. The final dataset contains 522 samples across 87 prompts and six models.

Five SAST tools produced 926 deduplicated candidate findings. The review classified 154 as true positives and 772 as false positives. Source: AI-Generated Code Security Study 2026 .

Vulnerability rates#

• 25.7% of samples contained at least one reviewed true-positive finding
• 522 total code samples tested across 6 LLMs (87 prompts per model)
• 154 reviewed true-positive findings remained from 926 deduplicated SAST findings
• GPT-5.2 had the lowest vulnerability rate at 19.5% (17 out of 87 samples)
• Claude Opus 4.6, DeepSeek V3, and Llama 4 Maverick tied for the highest rate at 29.9%
• Gemini 2.5 Pro came in at 23.0%, Grok 4 at 21.8%
• The observed spread between the lowest and highest sample rates was 10.4 percentage points

Each prompt was run once per model, so the study does not establish that the model-rate differences are statistically significant.

Most common weaknesses#

• SSRF (CWE-918) was the most common reviewed weakness with 32 findings
• Path traversal (CWE-22/23) was second with 30 reviewed findings
• Under OWASP Top 10:2025, A01 Broken Access Control led with 65 findings (path traversal + SSRF rolled in), followed by A05 Injection and A10 Mishandling of Exceptional Conditions tied at 22
• Flask debug-on (CWE-215/489) contributed 18 findings
• Deserialization of untrusted data (CWE-502) contributed 14 findings

Language comparison#

• GPT-5.2 showed the widest language gap: 11.6% vulnerability rate in Python vs 27.3% in JavaScript
• Claude Opus 4.6 was the only model where Python performed worse (32.6%) than JavaScript (27.3%)
• Grok 4 had the tightest cross-language gap at 1.7 percentage points

Security headers adoption#

I attempted requests to the Tranco Top 10,000 domains in February 2026 and recorded headers from 7,510 returned HTTP responses. That denominator includes 1,526 final 4xx or 5xx responses; 2,490 requests ended in a network failure or timeout.

Source: Security Headers Adoption Study 2026 .

Adoption rates#

• 51.7% of returned responses contained HSTS (Strict-Transport-Security), the highest share among the ten tracked security headers
• 49.5% contained X-Frame-Options
• 44.4% contained X-Content-Type-Options
• 28.4% contained Referrer-Policy
• 27.3% contained an enforcing Content-Security-Policy (CSP)
• 14.0% contained Permissions-Policy
• 10.0% contained Cross-Origin-Opener-Policy (COOP)
• 7.4% contained Cross-Origin-Embedder-Policy (COEP), the lowest share among the ten tracked headers

CSP configuration quality#

• The parser evaluated 2,345 responses with either enforcing CSP or, when enforcing CSP was absent, CSP-Report-Only
• 48.8% of those selected policies contained unsafe-inline
• 42.5% contained unsafe-eval
• 16.7% contained a nonce token
• 12.8% contained strict-dynamic
• 2,049 responses contained enforcing CSP, while 296 contained CSP-Report-Only

These are token-presence counts, not a semantic judgment of each complete policy.

HSTS configuration#

• 71.8% of HSTS responses set a max-age of at least 1 year
• 54.7% include the includeSubDomains directive
• 35.7% include the preload directive; presence alone does not prove preload eligibility or list membership
• 238 responses set max-age below one day

Adoption by site rank#

• Among 72 returned responses from the Top 100, 41.7% contained CSP and 68.1% contained HSTS
• Among 3,886 returned responses for ranks 5,001-10,000, 23.9% contained CSP and 47.7% contained HSTS

Other tracked headers#

• 27.1% of responses contained the deprecated X-XSS-Protection header
• 8.6% set Cross-Origin-Resource-Policy (CORP)

Open-source AppSec ecosystem stats#

I pulled GitHub and package-registry data for 64 open-source application security repositories across 8 categories. The snapshot covers stars, forks, contributors, releases, sampled issue close times, and available package counters.

Commit-activity data was unavailable for all 64 repositories. Source: State of Open Source AppSec Tools 2026 .

Community traction#

• 608,674 combined GitHub stars across all 64 repositories
• Ghidra is the most-starred open-source AppSec tool with 64,368 stars
• Jadx (47,291), mitmproxy (42,289), and Trivy (31,910) round out the top four
• Gitleaks (24,912) and TruffleHog (24,563) both ranked in the snapshot’s top 10
• Promptfoo (10,463 stars) was the only AI Security repository in the snapshot’s top 20

Custom score limitations#

• The custom score was nominally 0-100, but the missing commit-activity component removed 25 points for every repository
• The effective maximum in this snapshot was therefore 75
• The observed distribution was 7 repositories at 70-75, 42 at 50-69, 6 at 30-49, and 9 at 0-29
• 4 repositories fell below the page’s custom at-risk threshold of 20: Dastardly, w3af, Rebuff, and detect-secrets

The score does not measure code quality or security effectiveness.

Contributors and sampled issue timing#

• Trivy had 444 recorded contributors
• Renovate (432) and Kyverno (415) also have 400+ contributors
• Nikto had a 0.7-day median across 16 sampled closed issues
• Renovate had a 0.9-day median across only 2 sampled closed issues

These small, recently updated issue samples do not establish project-wide response times.

Language and license trends#

• GitHub listed Go or Python as the primary language for 51.6% of repositories
• Go leads with 29.7% (19 repositories), followed by Python at 21.9% (14)
• GitHub identified Apache-2.0 for 43.8% of repositories
• GitHub listed TypeScript as the primary language for two top-20 repositories, Promptfoo and Renovate

Category breakdown#

• Mobile security tools lead in raw star count (203,997) due to Ghidra, Jadx, mitmproxy, and Frida
• IaC Security has 13 tools with 100,000 combined stars
• SAST has the most tools (16) with 119,881 combined stars

Sources & methodology#

The three source studies were conducted in February 2026. This page reports their saved snapshots and does not treat them as current live counters.

AI-Generated Code Security Study 2026 The collection produced 534 outputs from 89 prompts across 6 LLMs. Two prompts were excluded, leaving 522 samples from 87 prompts in the final analysis. Five SAST tools produced the candidate findings; the final mapping uses OWASP Top 10:2025.

Security Headers Adoption Study 2026 The scan attempted the Tranco Top 10,000 and recorded ten security headers in 7,510 returned HTTP responses. Header-presence figures include final 4xx and 5xx responses; they are not full Mozilla Observatory scores.

State of Open Source AppSec Tools 2026 GitHub API data covers 64 repositories across 8 categories. It includes stars, forks, contributors, releases, sampled issue close times, and available PyPI, npm, or Docker Hub counters; commit-activity data was unavailable for every repository.

Frequently Asked Questions