A category I haven't given its own post yet: AI-powered website builders, the tools aimed at generating a marketing site, a portfolio, or a simple business page from a prompt, rather than a full application with a database and user accounts behind it. Worth being specific about how this category's risk differs from the app-builders I usually write about, because it's real, just usually smaller in scope.
Why the baseline risk is genuinely lower here
A pure marketing site, no login, no user accounts, no database of customer records, simply doesn't have most of what causes the incidents I write about. There's no row-level security to misconfigure if there's no database of per-user records to begin with. There's no admin route holding customer data if the entire site is public by design. A good chunk of this blog's checklist genuinely doesn't apply to a site that's meant to be fully public content in the first place.
Where the risk actually still lives
- Contact forms and lead-capture forms, which still need the same spam protection and rate limiting as any other public form, and often feed into an email service or CRM integration with its own key to protect.
- Any form field that gets stored somewhere, even a simple 'get in touch' submission, is still personal data sitting in a database or a third-party tool, worth the same basic care as any other stored personal information.
- Embedded third-party scripts, chat widgets, analytics, booking tools, which carry the same script-tag risk I've written about regardless of what generated the surrounding site.
- The moment a 'simple marketing site' grows a login-gated portal, a members area, a booking system with real customer data, it's stopped being a pure marketing site and has inherited the full checklist that applies to any app holding real user data.
The mistake worth avoiding in either direction
Treating a genuinely static, public marketing site with the same anxious checklist as a full multi-tenant SaaS app is overkill that wastes time on risk that doesn't exist for that specific project. Assuming that because a site started as "just a marketing page" it can never accumulate real risk, even after a contact form, a booking widget, and a customer portal get bolted on over time, is the opposite mistake, and the more common one I actually see.
The practical takeaway
Match the scrutiny to what the site actually does today, not to what category of tool built it. A pure content site built with an AI website builder genuinely needs less security attention than a full app. The same site, six months later, with a booking system and a customer login added on top, needs the full checklist, regardless of how it started or what generated the first version. The tool that built the site doesn't determine the ongoing risk. What the site actually does, right now, does.