I've written individual deep dives on most of the major AI coding platforms this year. Six months in feels like the right point to line them up side by side on the one question that's mattered most throughout: does the tool check anything for you automatically, or does it only help once you already know to ask.
Automatic, publish-time checks
Lovable's Security Scan and Bolt's automatic vulnerability check both run without the builder having to know to request them, at exactly the moment a builder is least likely to be thinking about security: right before shipping. This is the category I've consistently pointed to as the most effective pattern this year, because it protects the person who never would have known to ask.
Opt-in, but genuinely capable once used
Claude Code's /security-review command, and its newer free plugin, are powerful and well-built, and they do nothing until specifically invoked. Replit's scanning sits closer to the automatic end of this middle ground, built into the coding flow itself rather than requiring a separate manual step. The gap between these two groups isn't about capability. It's about whether the check happens by default or requires the builder to already know enough to reach for it.
Frontend-only tools, where the question doesn't fully apply
v0 mostly generates interface code without a backend of its own, which means the publish-time-scan question doesn't map cleanly onto it at all. Whatever backend gets connected separately carries its own security posture, entirely independent of v0 itself.
Tools where the real story wasn't a scanning feature at all
Windsurf's biggest story this year was an ownership shakeup, not a security feature. Base44's biggest story was a serious bug fixed quickly after an acquisition. Amazon Q's biggest story was its own supply chain being compromised. Not every platform's most important lesson this year fit into the "does it scan automatically" framework at all.
The pattern that's held all year
Automatic checks catch mistakes for people who'd never have known to look. Opt-in checks, however capable, only help the subset of builders who already have the instinct to reach for them. Every incident I've covered this year happened to someone who, as far as the public record shows, never had a check run before launch. That's the actual dividing line worth watching as more platforms build out their security tooling this year, more than any individual feature announcement.
What I'd want to see more of in the second half of the year
More of the automatic category, specifically. A capable opt-in tool is genuinely valuable for the builder who reaches for it. The builders who make up nearly every incident on this blog are, almost by definition, the ones who didn't reach for anything, and the only thing that's reliably protected that specific group all year has been a check that ran without anyone asking.