A quarter of the year is behind us, which feels like a reasonable point to step back rather than stay heads-down on the next specific check. Looking back at everything I've written since January, one pattern stands out clearly enough to name on its own.
The platforms are genuinely improving, and quickly
In three months, I've written about Cursor shipping an agent that automatically tests and patches security findings, OpenAI launching Codex Security with actual threat-modeling instead of pattern matching, and Claude Code's deeper security capability moving into limited preview. None of that existed, or existed in this form, at the start of the year. The pace of real, substantive security investment across these tools has been faster than I expected when I started writing daily in January.
The incidents haven't slowed down at the same pace
In the same three months, an AI-agent social network launched and had its database exposed within four days. A researcher disclosed 16 vulnerabilities in a Lovable-built exam app serving three university systems and K-12 schools, after a support ticket about it reportedly went nowhere. A well-funded, newly acquired platform had a critical authentication bypass that let anyone log into any private app with nothing but a public ID, only patched after outside researchers found it. None of these trace back to a lack of available tooling. They trace back to the same handful of checks that were already free, already documented, and still didn't get run before launch.
Why better tools haven't closed this gap yet
A more capable scanner or a smarter agent only helps the person who actually runs it, or who's building on a platform that runs it automatically. Every incident I've covered this quarter happened to a builder who, as far as the public record shows, never got a security check in front of them before launch, either because the tool they used didn't run one automatically, or because nobody thought to reach for one manually. Tooling capability and tooling adoption are two separate curves, and only one of them has clearly bent upward this quarter.
What I'd actually want to see change in the next quarter
Not more capable tools, necessarily, though I'd welcome that too. More of the existing capability running by default, without requiring the builder to already know to ask for it. The tools that check automatically at publish time have already shown this works: it catches exactly the class of mistake that keeps causing headlines, for people who would never have known to run a manual check in the first place.
Three months in, my actual advice hasn't changed since January, and I don't expect it to change much by the next check-in either: run the basic checks, whether or not your tool does it for you automatically, before real user data ever touches what you've built. The tools are getting better at helping with that. Whether that help reaches the person who needs it before launch, not after, is still the open question.