Claim boundary
Three categories of detector claims
The safest language changes with the evidence category. Most misleading reports turn an inference into an observation or an unknown into a percentage.
The delivered page contains a named builder marker.
The marker exists in the public response and can be reproduced.
The page uses recurring class, structure or design patterns.
Those patterns can be recorded from delivered HTML and assets.
The pattern cluster resembles an AI-assisted reference corpus.
Similarity depends on the selected features, corpus and model boundary.
A particular builder may have influenced part of the site.
A marker or convention can be inherited, copied, removed or introduced indirectly.
AI wrote 73% of the website.
A public response contains no denominator for private source creation or later human edits.
The website owner personally used AI.
Authorship and workflow are private provenance questions.
Why certainty breaks down
The public website is the end of a lossy pipeline
Between an initial prompt and the page you receive, code may be regenerated, refactored, bundled, minified, copied into another project or mixed with years of human work. Templates and design systems also create the same repeated patterns that detectors may associate with AI-assisted production.
This is a classic correlation problem: a feature can be predictive inside one frozen dataset without being a unique cause in the open web. A model result therefore needs a defined corpus, holdout evaluation, uncertainty and a careful label.
- Absence of a marker is not evidence of absence
- Presence of a marker is not a generated-code percentage
- Visual similarity is not a defect count
- Security posture is independent from production method
Decision matrix
Match the method to the claim
A public scan is useful when the decision fits its evidence boundary. Broader claims need broader access.
| Question | Useful evidence | What remains missing | Responsible outcome |
|---|---|---|---|
| Does the page resemble common vibe-coding patterns? | Delivered HTML, assets and visual structure | Private workflow and complete source | A bounded similarity assessment |
| Was a builder used somewhere? | Direct marker plus repository or deployment history | Who used it and how much it influenced | A trace with provenance caveats |
| Who authored the product? | Contracts, commits, design history and team records | Unrecorded collaboration and edits | A provenance review, not a URL score |
| Is the website safe? | Headers, application tests, code review and threat model | Unknown systems outside the assessment | Scoped security findings with severity |
| Is the website good? | User research, accessibility, performance and product outcomes | Context-specific goals and trade-offs | A multi-dimensional quality review |
Applied example
Why a precise percentage can be less trustworthy
A detector reports ‘87% AI-generated’ after fetching a minified production bundle. The report does not define whether the denominator is files, tokens, components, runtime bytes or model probability.
- The number cannot be independently interpreted without a measurement definition.
- Minification and bundling remove or transform much of the original source structure.
- Training-corpus similarity does not convert automatically into generated-code share.
- The precision of the number may create confidence that the method has not earned.
Plain answers
Detector questions
Are direct builder fingerprints useless?+
No. They can support a narrow, reproducible observation. The mistake is expanding that observation into a complete claim about authorship or generated-code share.
Why does VibeFootprint still use a 0–100 number?+
The number is an orientation index for similarity within a frozen method. The interface pairs it with evidence breadth, score drivers and explicit limitations so it is not presented as an AI percentage.
Could detection improve with repository access?+
Repository history, source maps and process records can improve provenance analysis, but mixed authorship, copied code and rewritten history still require careful interpretation.