Quttera, a provider of continuous website and web application integrity monitoring, today released new research examining how website and web application security is moving earlier into the software lifecycle: out of post-deployment add-ons and into the moment a website or application is published. Quttera research AI builders move website security into the publish decision.
Quttera research examines how website and web application security is moving into the publishing workflow while integrity verification continues after deployment. New analysis examines how AI application builders are bringing security into publishing — and why verification must continue after deployment.
"Security for websites and web applications is moving into the publishing decision," said Michael Novofastovsky, CTO and co-founder of Quttera. "But publication is still a single point in time. Integrity evidence has to continue after the asset goes live."
Each platform the research examined takes a different route to that same destination. Base44 surfaces application security status and scan results in its production workflow. Lovable says a basic security scan runs automatically whenever an application is published, and lets administrators configure publication to be blocked when critical findings remain unresolved. Replit pairs pre-publication security analysis with ongoing dependency monitoring after an application goes live.
The specifics differ by platform, but Quttera's analysis finds a consistent direction: the question a builder once had to answer for themselves — "Have I secured this correctly?" — is increasingly being addressed inline, at the moment they decide to publish.
That shift raises the question the research spends most of its time on: what happens after Publish?
A website or application security check performed at deployment does not permanently establish that a live web asset remains safe. Dependencies get updated. New vulnerabilities are disclosed. Third-party scripts and embedded resources can change behavior without a new deployment. Credentials can be compromised. Configurations drift. Content changes. The asset a platform verified at launch is not guaranteed to be in the same state weeks — or even hours — later.
To address that gap, Quttera's research distinguishes between two complementary views of a live asset's security and integrity.
Platform-native security draws on internal information only the builder can see: source code, installed packages, permissions, configuration, and build history.
Independent deployed-state verification instead examines what the live asset actually presents and does from the outside — its public pages, delivered scripts, redirect behavior, and blacklist or reputation status — independent of whichever platform created it.
The research also looks ahead to how this question may expand as websites and applications become accessible not just to human visitors and browsers, but directly to AI agents. It points to the WebMCP Community Group draft, which explores how web applications could expose structured capabilities for AI agents to discover and invoke — meaning a live web asset may increasingly be something an AI system acts through, not only something a person views, or a crawler reads.
The analysis also cites Cisco Talos research documenting a case in which attackers used an AI-assisted web application platform to build a credential-harvesting page — illustrating, Quttera argues, how the same tools that lower the barrier to building legitimate web applications can also lower the barrier to building abusive ones.
Quttera calls this ongoing-verification model Continuous Web Integrity: maintaining evidence about a live web asset's security and integrity over time, rather than treating a single successful scan, deployment, or approval as permanent proof of safety.
About Quttera
Quttera delivers continuous integrity and threat monitoring for websites and digital assets that must remain safe, discoverable, and commercially viable for both human visitors and AI-driven systems.
