AI is making it easier than ever to build software.

Unfortunately, it is also making it easier to deploy insecure software.

Today I tested the web application security scanner from Grovetech AI on my personal website, vesely.sk.

Overall, I was genuinely impressed.

Not because it found critical vulnerabilities on my website. It did not.

I was impressed because it explained security findings in a way that developers, not only security professionals, can actually understand.

AI has changed the speed of building

As someone working in cybersecurity for many years, I am seeing a clear trend.

Developers can now build applications in hours using AI assistants such as ChatGPT, Claude Code, GitHub Copilot, Cursor, or other “vibe coding” tools.

Deploying to platforms like Vercel, Netlify or Cloudflare Pages has never been easier.

That is powerful.

But it also changes the risk profile.

When the path from idea to production becomes shorter, the space for security thinking often becomes shorter too.

The problem is not only code quality

The problem is that security often becomes an afterthought.

I regularly see applications deployed with:

  • missing Content Security Policy (CSP),
  • weak or missing security headers,
  • missing CAA records,
  • missing security.txt,
  • overly permissive CORS configurations,
  • and other basic hardening issues.

Most of these are not difficult to fix.

But only if you know they exist.

That is where practical preflight checks matter.

A tool does not need to replace a security engineer to be useful. It can still help developers notice basic exposure before the application is public, indexed and shared.

A simple static website can still teach useful lessons

My own website is intentionally simple.

It is a static Astro and Markdown website hosted on Vercel, with DNS managed by Cloudflare.

Even there, the scanner provided useful insights and highlighted areas worth reviewing.

Some findings were immediately actionable. Others needed interpretation.

That distinction matters.

Security scanners are not legal judgments or final audit reports. They are inputs into engineering decisions. A good scanner should help people understand what it found, why it matters, and when a recommendation is context-dependent.

Not every recommendation applies equally

I did not agree with every recommendation.

Some findings are more relevant to dynamic web applications than to static websites. Some checks need context. Some crawler-oriented findings are useful, but should not be confused with exploitable security vulnerabilities.

I shared that feedback directly with the author.

That is completely normal.

Security tools evolve through real-world usage, disagreement, edge cases and constructive discussions.

What I appreciated most was the author’s openness to feedback and willingness to discuss potential improvements.

That is a good sign for any security product.

Security needs to move earlier

If you are building websites or web applications with AI assistance, I strongly recommend running a security scan before publishing your project.

It only takes a few minutes, and you may discover issues that would otherwise go unnoticed.

Security should not be something we think about after deployment.

It should be part of the development process from day one.

Especially now, when AI makes it so easy to ship quickly.

Fast development is useful.

Fast insecure development is debt.

Secure-by-design is becoming practical

Secure-by-design does not have to start with a huge framework.

It can start with a small checklist:

  • use HTTPS correctly,
  • enable HSTS where appropriate,
  • set basic security headers,
  • define a Content Security Policy,
  • avoid exposing secrets,
  • check CORS behavior,
  • publish security.txt,
  • keep AI and crawler metadata intentional,
  • and verify the result after deployment.

These are not exotic controls.

They are basic hygiene.

But in the age of , basic hygiene matters more, not less.

Congratulations to the Grovetech AI team. I am looking forward to seeing how the product evolves.

Original LinkedIn post: Peter Veselý on AI-assisted development and web security.