Brief Description
This research investigates the security vulnerabilities and structural complexity of websites generated by the DeepSite platform, an AI-driven no-code website builder. The study will analyze a large set of generated websites to determine how secure these automatically produced systems are, and how their structural complexity (e.g., code size, dependency chains, asset requests) correlates with vulnerability risk. The ultimate goal is to benchmark the safety and maintainability of AI-generated websites in comparison to traditional web development.
Research Questions
Security risks: What types of vulnerabilities (SQL Injection, XSS, insecure file upload, etc.) are most common in DeepSite-generated websites?
Complexity vs. security: Does higher structural complexity (e.g., larger DOM, more dependencies, nested code) correlate with more vulnerabilities?
Comparison: How do AI-generated websites differ from traditional developer-built websites in terms of both vulnerability prevalence and complexity metrics?
Benchmarking: Can we define a standardized methodology for evaluating AI-generated websites that can be applied to other tools (e.g., Wix ADI, GitHub Copilot for Web)?
Methodology
Dataset Creation:
Generate ~50 websites using DeepSite, across categories (blogs, portfolios, e-commerce, landing pages).
Deploy them in isolated Docker containers for controlled testing.
Security Evaluation:
Automated scanning with Burp Suite and OWASP ZAP.
Static analysis with Semgrep and SonarQube.
Manual validation for high-confidence vulnerabilities (file upload, input handling).
Complexity Analysis:
Metrics: Lines of code, DOM tree depth, number of external dependencies, JavaScript libraries included, HTTP requests.
Complexity scoring inspired by McCabe’s Cyclomatic Complexity and web-specific indicators.
Data Analysis:
Proportions of websites with at least one exploitable vulnerability.
Correlation between structural complexity metrics and vulnerability count (Spearman/Pearson correlation).
Comparisons to small control group of human-coded websites (e.g., from GitHub open-source templates).
Related Literature
Tóth, R., Bisztray, T., Erdődi, L. (2024). LLMs in Web Development: Evaluating LLM-Generated PHP Code Unveiling Vulnerabilities and Limitations. In: Ceccarelli, A., Trapp, M., Bondavalli, A., Schoitsch, E., Gallina, B., Bitsch, F. (eds) Computer Safety, Reliability, and Security. SAFECOMP 2024 Workshops. SAFECOMP 2024. Lecture Notes in Computer Science, vol 14989. Springer, Cham. https://doi.org/10.1007/978-3-031-68738-9_34
Tihanyi, N., Bisztray, T., Ferrag, M.A. et al. How secure is AI-generated code: a large-scale comparison of large language models. Empir Software Eng 30, 47 (2025). https://doi.org/10.1007/s10664-024-10590-1
Mohamed Amine Ferrag, Fatima Alwahedi, Ammar Battah, Bilel Cherif, Abdechakour Mechri, Norbert Tihanyi, Tamas Bisztray, Merouane Debbah,
Generative AI in cybersecurity: A comprehensive review of LLM applications and vulnerabilities, Internet of Things and Cyber-Physical Systems, Volume 5, 2025, Pages 1-46, ISSN 2667-3452, https://doi.org/10.1016/j.iotcps.2025.01.001.- Norbert Tihanyi, Tamas Bisztray, Ridhi Jain, Mohamed Amine Ferrag, Lucas C. Cordeiro, and Vasileios Mavroeidis. 2023. The FormAI Dataset: Generative AI in Software Security through the Lens of Formal Verification. In Proceedings of the 19th International Conference on Predictive Models and Data Analytics in Software Engineering (PROMISE 2023). Association for Computing Machinery, New York, NY, USA, 33–43. https://doi.org/10.1145/3617555.3617874