AI Coding Tool Security
Each of these tools produces working software quickly, and each fails in its own characteristic way — because how a tool is used determines what goes unreviewed. An editor that changes a whole repository leaves different gaps than a generator that ships an entire app in one pass.
These pages describe patterns we look for in code produced with each tool. They are not claims that any tool is insecure — unreviewed output is the problem, and that applies to every one of them.
Cursor
Anysphere
Is code written with Cursor safe to ship?
Read the guide →GitHub Copilot
GitHub
Is code suggested by GitHub Copilot secure?
Read the guide →Bolt
StackBlitz
Is an app built with Bolt safe to launch?
Read the guide →v0
Vercel
Is code generated by v0 safe to use in production?
Read the guide →Replit
Replit
Is a Replit project safe to make public?
Read the guide →Lovable
Lovable
Is an app built with Lovable secure enough for real users?
Read the guide →Not sure which applies to you?
Most projects use more than one of these. Point a scan at the repository and it reports what is actually there, whichever tool produced it.