This one comes up almost every time I talk to someone about their app for the first time: "I built it with a well-known tool, so I assumed the security side was handled." It's an understandable assumption, and it isn't quite right, for a specific, explainable reason.
What a good AI coding tool is actually optimizing for
These tools are extraordinary at generating working features quickly, translating a plain-English description into functioning code. Several of the more established ones have also added their own baseline security scanning over the past year, which is real, meaningful progress. That scanning generally checks for known, common patterns, not your specific app's specific business logic, and it happens at the tool level, not as a guarantee about the finished product you actually ship.
Why "the tool is reputable" doesn't transfer to "my app is checked"
A tool's built-in scan runs against general patterns it's designed to catch. It doesn't know that your specific sharing feature should only let an owner invite collaborators, or that your specific pricing logic should never let a discount stack twice. Those are decisions unique to your app, made through prompts and follow-up requests, and a general-purpose scan wasn't built to verify decisions it has no way of knowing about.
A useful way to think about the split
The tool is responsible for the code it generates being reasonably well-formed and, increasingly, scanned against common issues. You, or whoever configured your specific database rules, connected your specific third-party services, and defined your specific access logic, are responsible for whether all of that fits together correctly for your particular app. A tool's reputation says something true about the first part. It says nothing reliable about the second.
What to actually do with this
Using a well-regarded tool is a genuinely good decision, and worth continuing to make. Treating that decision as the whole security story, rather than one input into it, is the part worth correcting. The tool built the app. Whether the app, as configured for your specific case, is actually safe to put in front of real customers is still a separate, answerable question.