Post History

My understanding (from sometimes working on the older form) is that your instinct hits pretty close to the mark.  It often depends on what you need and (increasingly importantly) how rigid a system you have.

For a "what you need" example, consider Stripe.  You have an account with them, and you can either send your traffic to their site, or they'll provide a blob of JavaScript that will insert their widgets into the page.  You can't build a full store and shopping cart that way, because that requires communicating back and forth, but most people can accept that gap.  They handle the security, in other words.  Most providers work that way.

On the rigidity side, as you suggest, as long as you drop in fixed components, flaws might creep in, but Stripe-or-whoever has a strong motivation to not let fraud bounce around their system.  But as the system becomes more flexible, letting developers (and these people *do* develop software, even if not for a living) do whatever they want will inevitably open security hole.

Sometimes, you don't even need the developer to do anything, such as with WordPress's long reputation as a primary target for hackers pushing spam and malware to readers.  Because WordPress became so popular, you had many more people interested in attacking it than Automattic had cleaning up security holes.  But LLM-based systems almost certainly have security problems, because LLMs introduce [security vulnerabilities in almost half of all changes](https://www.securitymagazine.com/articles/101801-ai-introduces-security-vulnerabilities-within-code-in-45-of-cases), turns out...

None of the site-builders has some secret tool that carefully validates the security, though.  If they did, then we'd hear about it, because selling that tool would net them orders of magnitude more money than helping college kids sell bracelets and the like.