Looking back at the past year, nearly every major AI coding tool added its own built-in security checking: Anthropic's security-review command in Claude Code, Cursor's Bugbot and Autofix, Bolt's publish-time scan, Replit's Security Agent and Package Firewall, OpenAI's Codex Security. That's a real, meaningful shift, and it's worth actually sitting with why it happened before getting to what it still doesn't cover.
Why this happened all at once
It wasn't a coincidence. A string of genuinely serious incidents, exposed databases, leaked keys, apps built on these platforms getting compromised, made the risk impossible to wave away as a rare edge case. Every major tool responding with its own scanning feature is these companies correctly reading the room, and I think it's a real, positive development worth giving them credit for.
What every one of these tools shares as a limitation
Each one checks its own platform, using its own patterns, at one specific moment, usually build or publish time. None of them can verify your live production database's actual access rules once real data is flowing through it. None of them understand your specific business logic well enough to catch the workflow-specific mistake that's unique to your particular app. And if you built with more than one tool, or moved a project between them, none of them see the whole picture.
Why I built Harbova as something separate from all of it
The gap I kept running into, doing this by hand for a year before building the scanner, wasn't inside any single tool's code. It was in the outside view: what does this specific live app, as it actually exists right now, expose to a stranger who finds it. That's a question none of these built-in tools are positioned to answer, because they're looking at code at build time, not at your actual, deployed app from the outside, the way a real visitor or a real attacker would find it.
The honest read
These built-in tools are worth using, genuinely, and I'd never suggest otherwise. They catch real things, early, before code ships. An outside check, looking at what's actually live and reachable, catches a different, later-stage layer of the same problem. Neither replaces the other, and that's exactly the gap between them that Harbova's scan was built to sit in.
Related reading
- v0 Builds Beautiful Interfaces. It Has Nothing to Say About What's Behind Them.
- What Claude Code's Built-In Security Review Actually Catches
- What Bolt.new's Built-In Security Check Actually Looks At
See what your live app actually exposes from the outside, free, in under a minute.
Scan my app free