Landing pages
Landing pages leak more than you think
A static marketing page can still expose stack details, forgotten scripts, source maps, draft routes, and indexing mistakes.
· 4 min read
Landing pages feel low risk because they often have no accounts and no database. But they are still public software, and public software has a surface. The common mistakes are not database breaches — they are forgotten integrations and accidental files.
The things that accumulate
AI-built landing pages collect fragments from examples: analytics tags, chat widgets, remote images, font imports, demo API routes, old source maps, and placeholder robots settings.
Each one changes what the page exposes or who it talks to. A font import is a third-party request. A chat widget is someone else's JavaScript with full access to your page. Neither is necessarily wrong, but both should be there on purpose.
Inspect from the outside
Open the network panel and ask blunt questions. Does the page make third-party requests? Is there a tracking script you did not intend to ship? Are paid links marked correctly? Is the site indexable if it should be, and private if it should not be?
The answers are facts about the deployed page, not about your intentions or your source tree — which is why reading the code is not a substitute for looking.
It is the first thing anyone sees
A landing page is part of your security posture whether you treat it that way or not. It is usually the first thing customers, crawlers and scanners encounter.
It is also the page most likely to be screenshotted by someone running a scan against you, which is a strange kind of pressure but a real one.
Common questions
Does a static landing page need a security review?
A short one, yes. It cannot leak a database, but it can leak stack details, load third-party code, expose forgotten files, and quietly carry a noindex directive that keeps you out of search entirely.
How do I find third-party requests on my page?
Open the browser network panel and filter to third-party domains, or run an external scan that reports them. Anything not served from your own origin is a dependency you have taken on.
Do I need to mark sponsored links?
Yes. Paid links should carry rel="sponsored", and undisclosed paid links are both a search guideline violation and a disclosure problem.
Keep reading
The security checklist for vibe-coded websites
A practical pre-launch pass for sites built quickly with AI: the checks that catch public mistakes without turning the project into a month-long audit.
Exposed env files still lose keys fastest
The oldest mistakes keep appearing in the newest stacks: public .env files, forgotten backups, and source maps with secrets inside them.
Why AI-built sites forget security headers
Generated code optimises for visible functionality. Security headers stay invisible until a scanner, a browser, or an attacker asks for them.