Hostinger has started automatically scanning Node.js applications for security vulnerabilities after they go live, a move aimed squarely at the growing pile of apps that AI tools helped build in minutes but that nobody has really looked at since.
The company partnered with Patchstack, a firm that tracks vulnerabilities in open-source code, to build the scanning directly into its Node.js hosting. Once a developer deploys an app, Hostinger checks its dependencies against newly disclosed vulnerabilities on an ongoing basis and alerts the developer when something needs fixing, along with guidance on how to fix it.
The problem the partnership addresses is a fairly new one. AI coding tools now let a single developer spin up a working app in an afternoon, but that app usually leans on dozens of third-party packages nobody manually reviewed. New vulnerabilities in npm packages surface constantly, and AI-generated code is multiplying the number of apps built this way, so the gap between “shipped” and “actually secure” keeps widening. Solo builders and small teams, in particular, rarely have the bandwidth to track security advisories once a project is live.
“When you’re building with AI tools, you’re focused on getting the product live, not on what happens to your dependencies six months later,” said Arnas Donauskas, Hostinger’s web hosting product manager. He described the risk as something that quietly accumulates over time rather than showing up all at once, which is exactly what the Patchstack integration aims to catch.
Hostinger built the Node.js hosting itself with AI-generated, or “vibe-coded,” projects in mind. Developers can export an app from a tool like Lovable straight to GitHub, connect the repo to Hostinger, and the platform detects the framework and deploys it automatically, no server configuration required.
Patchstack’s CEO, Oliver Sild, framed the timing plainly: AI has made building applications easier, but open-source dependencies keep changing after launch, so a one-time scan isn’t enough.
The scanning now runs by default on Hostinger‘s Business web hosting and its Cloud Startup, Professional, Enterprise, and Enterprise Plus plans. Customers don’t need to turn it on or configure anything themselves.
