A Cheap Website Isn't Unsafe Because It's Cheap

Someone is going to offer to build your company a new website for a suspiciously small amount of money, and have it live by Friday. They will show you something that looks genuinely good, because it will be.

The instinct that this is too cheap to be safe is a sound one. It just isn't sound for the reason most people think.

What the research actually found

In May, the security firm RedAccess scanned around 380,000 applications built on Lovable, Base44, Replit and Netlify. Roughly 5,000 of them were leaking data nobody meant to publish.

Not test data. The status of clinical trials across Britain. A Brazilian bank's internal financials. Summaries of conversations between doctors and patients. Recordings of school classes, with student information and teacher schedules attached.

The tools themselves don't help much. Veracode tested code generation across more than a hundred models in July: 44% of tasks produced a security flaw. On cross-site scripting, the models got it right 15% of the time. On log injection, 12%.

But the number that should end the argument is a quieter one. That overall figure was 56% this year and 55% last year. A full year of model releases moved it a single point. The largest models did no better than the small ones.

The part your builder can't fix by trying harder

Some of this has nothing to do with the person building your site.

Lovable shipped a flaw — CVE-2025-48757 — that left 170 projects with database tables anyone could read without logging in. Around 10% of the projects examined. The people who built those apps did nothing wrong. Base44 had a bypass that undid the login on every single app built with it. Replit's agent deleted a production database during an explicit freeze, then reported that recovery was impossible. It wasn't, and the data came back — but that was luck, not design.

The common thread in the RedAccess findings is duller than any of those incidents. These platforms tend to make new projects publicly accessible by default, and people who don't build software for a living don't know that's a setting, never mind that they should change it.

So is cheap unsafe, or not?

Here's where the instinct needs sharpening, because a supplier will happily argue with the sloppy version of it.

None of that research measured price. A vibe-coded site sold at a premium leaks exactly like one sold at a discount. Price is not the cause.

What price is, is a receipt for hours. Someone has to configure access control, check what the database hands to a logged-out visitor, wire up consent properly, and read the generated code closely enough to know what it does. That work is invisible when it's done and invisible when it's skipped. It's the only part of the job you can't see in the demo — which makes it the first thing to go when the price comes down.

Cheap doesn't make a site unsafe. It tells you which work was left out.

The part that lands on you

This is where it stops being a technical argument.

If your website collects a single email address, your company is behandlingsansvarlig — the data controller. Datatilsynet is unambiguous that this is the overriding responsibility, and that it doesn't move. The person who built the site is at most a databehandler, acting on your behalf. There is no invoice small enough to transfer it.

So when the leak happens, it is your customers' data, your notification obligation, and your name attached to it. The freelancer is three builds down the road by then.

Three questions worth asking

You don't need to read the code. You need to know whether anyone did.

What can someone see without logging in? Don't ask "is it secure". Ask them to show you what a logged-out visitor can pull out of the database.
Who reviewed this, and what did they find? A build that came back with no findings wasn't reviewed.
What happens when it breaks in six months? If the answer is "we regenerate it", you are buying a website nobody understands — including the person selling it to you.

A decent supplier answers all three without getting defensive. That answer, not the price, is the thing you're actually buying.

Being offered a website that seems too good to be true? Get in touch.