Based on our analysis of over 500 Claude‑generated websites, we identified four critical weaknesses that appear in more than 70% of projects. Exposed environment variables top the list – developers often forget to move API keys from code to server‑side .env files. Insecure default headers (or none at all) leave sites vulnerable to clickjacking and XSS. Unvalidated user input leads to injection attacks, and weak session management makes it easy for attackers to hijack user accounts.
Claude is trained to produce code that works, not code that is hardened against attacks. It doesn't "know" about your specific deployment environment or the threat model of your application. It will happily generate a form that sends data directly to a database without sanitization, or include an inline