What do apps miss?
When Sloptic graded 1,579 apps in 80 hackathons, it found that...
Nothing is clean
The median is 48, and a quarter scored above 78.2. No app scored 0 and the cleanest scored 1. In other words, there is slop in every app.
More stats
- 58.6average slop
- 40.4standard deviation
- 337.5worst app
What was the slop like?
Different slop have different severities. While most are chronic and indicative of hygiene, quite a few apps have serious or critical problems. The table below shows the number of instances of slop of each kind and how many apps have what:
| penalty | band | findings | share | apps with at least one | |
|---|---|---|---|---|---|
| 1-10 | minor | 6,852 | 76.0% | 1,575 (99.7%) | |
| 11-20 | moderate | 832 | 9.2% | 709 (44.9%) | |
| 21-30 | serious | 607 | 6.7% | 520 (32.9%) | |
| 31-40 | severe | 224 | 2.5% | 212 (13.4%) | |
| 41+ | critical | 506 | 5.6% | 435 (27.5%) | |
| all | 9,021 | 100% | (these overlap) | ||
When evaluated on its single worst slop instance, this is what apps had:
- Hygiene100%1,579 apps
E.g. missing headers, poor accessibility, orange Lighthouse score; the things people often skip.
- Significant58.1%918 apps
Findings that are not just cosmetic, such as dead controls, broken links, missing rate limits, overly slow pages.
- Acute27.5%435 apps
Severe issues that noticeably degrade the user experience or allow attacker access, such as crashes, unusable pages, or exposed backends.
- Exploitable4.7%75 apps
Catastrophic vulnerabilities that an attacker can exploit today.
What do teams miss?
The most common kinds of slop are missing security headers, accessibility issues, and slow performance. Most are invisible to the teams building the apps.
About 4 in 5 of those have low contrast text.
The median score is 83.
The eight most common findings, by share of graded apps. Why is my score bad when my app is fast?
Are AI-built apps sloppier?
Not overall. Lovable apps carry a median slop of 50.2 against 47.9 for hand built apps, a gap small enough to be chance (p = 0.16). Bolt has only 9 apps which is too few to compare.
Backends make up the difference, as Lovable and Bolt both offer Supabase as a built in database and AIs rarely configure it properly.
11 of 82 Lovable and Bolt apps.
9 of 1,497. AI-built apps did it about 22 times as often.
Are winners cleaner?
No, but not dirtier either. Winning apps carry a median slop of 52.7 against 47.6 for everyone else, which can be chalked up to chance (p = 0.22). Winners' apps crash, leak secrets and have nonfunctioning buttons at the same rates as everyone else.
But speed does differ, as winning apps are heavier and hence score lower on Lighthouse (p = 0.003):
Are faster apps cleaner?
Not exactly. When we measured performance (via Lighthouse) against the slop without the performance axis, the correlation is -0.072 across the1,538 apps, which is close enough to zero to call the two independent.
- -0.072Spearman correlation between Lighthouse performance and the rest of the slop
Breakdown per hackathon
Across 59 hackathons out of 80 with 8 or more graded apps, median slop runs from 21 to 101.8, a 4.8x difference. Hover over a bar for the event in question.
How many are exploitable?
Yet only 4.7% of apps had an exploitable vulnerability. The largest class is a credential in the bundle, most often (27 apps) a Google API key that can call the Gemini API. Next is an open Supabase or Firebase database, as 16 apps lacked row level security which allowed an anonymous client to read or write rows. See the table below for details:
What didn't get graded
Sloptic attempted 2,685 apps and graded 1,579 of them, or 58.8%. Most of the rest were due to link rot (expired free tier), timeouts, a WAF/bot challenge, or other reasons.
Also excluded are 82 streamlit apps, 2 unknown apps, 1 github-pages apps, 1 firebase apps since Sloptic is currently unable to properly separate what the teams built from these platforms.