AI Coding Tool Security

Each of these tools produces working software quickly, and each fails in its own characteristic way — because how a tool is used determines what goes unreviewed. An editor that changes a whole repository leaves different gaps than a generator that ships an entire app in one pass.

These pages describe patterns we look for in code produced with each tool. They are not claims that any tool is insecure — unreviewed output is the problem, and that applies to every one of them.

Not sure which applies to you?

Most projects use more than one of these. Point a scan at the repository and it reports what is actually there, whichever tool produced it.