Where these 23 reports land
Build it1
Scope it4
Keep it18
Category report
Security
23 products ranked by how much of their useful core an AI coding agent can reproduce: 1 strong build, 4 scoped builds, and 18 weak replacements.
How the score breaks down here
- Interface
- 37
- Core workflow
- 30
- Data access
- 28
- Operations
- 15
- Trust & safety
- 15
30/100 average buildability
Why people keep paying here
- brand trust22 of 23 reports
Trust, audits, and counterparties matter more than feature parity.
- scale infra16 of 23 reports
Reliability at the vendor's scale is an operations problem, not a prompt.
- compliance regulatory5 of 23 reports
Compliance, licensing, and legal accountability are core features.
The typical achievable core in this category: prototype the workflow, but rely on audited libraries and established security tools.
Build it
Bitwarden
If your goal is to stop paying hosted Bitwarden Premium, the core vault can be self-hosted or replaced with KeePass-style local storage; the caveat is security responsibility.
Scope it
1Password
A basic encrypted vault is buildable, but browser autofill, mobile apps, passkeys, sharing, recovery, audits, and trust make this a dangerous thing to replace casually.
Scope it
Dashlane
A simple vault is buildable, but matching Dashlane's extension/mobile autofill, passkey support, breach monitoring, sharing, and trust posture is not a casual clone.
Scope it
Enpass
The core loop is buildable, but a dependable replacement becomes a substantially larger project. For Enpass, store an encrypted vault locally and optionally sync it through the user's own cloud folder. The hard boundary is mature apps, browser extensions, platform biometrics, and ongoing security maintenance, plus security assurance, infrastructure, and trust.
Scope it
ZeroLeaks
The mechanics here are not exotic: fire a few hundred adversarial prompts at your own chat endpoint, capture the responses, and check whether any of them contain your system prompt, tool schemas or API keys. An agent can build that loop, including an LLM-as-judge scorer and an HTML report, in a focused implementation, and it will find the embarrassing stuff on day one. What you cannot one-shot is a probe library that stays current with each new model release and each new jailbreak family, because that is maintained knowledge, not code. There is also a trust angle: 'we ran our own script and found nothing' reads very differently in a security review than a dated third-party report. Build it for your own sanity checks, keep paying if you need something to show someone else.
Keep it
NordVPN
A consolation build is possible, but the paid product's decisive value sits outside a solo rebuild. For NordVPN, configure a private tunnel to a user-owned server for personal remote access. The hard boundary is global server fleet, capacity, obfuscation, audits, apps, abuse response, and support, plus security assurance, infrastructure, and trust.
Keep it
Arq Premium
Do not mistake the interface for the product. Arq Premium's durable value is security, infrastructure, trust, which a solo one-shot build cannot reproduce responsibly. The prompt therefore builds only the closest honest personal consolation tool.
Keep it
ExpressVPN
Do not mistake the interface for the product. ExpressVPN's durable value is security, infrastructure, trust, which a solo one-shot build cannot reproduce responsibly. The prompt therefore builds only the closest honest personal consolation tool.
Keep it
IDrive
Do not mistake the interface for the product. IDrive's durable value is security, infrastructure, trust, which a solo one-shot build cannot reproduce responsibly. The prompt therefore builds only the closest honest personal consolation tool.
Keep it
Intego
Do not mistake the interface for the product. Intego's durable value is security, infrastructure, trust, which a solo one-shot build cannot reproduce responsibly. The prompt therefore builds only the closest honest personal consolation tool.
Keep it
Malwarebytes
Do not mistake the interface for the product. Malwarebytes's durable value is security, infrastructure, trust, which a solo one-shot build cannot reproduce responsibly. The prompt therefore builds only the closest honest personal consolation tool.
Keep it
Mullvad
Do not mistake the interface for the product. Mullvad's durable value is security, infrastructure, trust, which a solo one-shot build cannot reproduce responsibly. The prompt therefore builds only the closest honest personal consolation tool.
Keep it
Proton Pass Plus
A consolation build is possible, but the paid product's decisive value sits outside a solo rebuild. For Proton Pass Plus, create a local password and alias vault with portable encrypted backup. The hard boundary is proton identity, email alias infrastructure, audits, apps, recovery, and privacy operations, plus security assurance, infrastructure, and trust.
Keep it
Proton Unlimited
Do not mistake the interface for the product. Proton Unlimited's durable value is security, infrastructure, trust, which a solo one-shot build cannot reproduce responsibly. The prompt therefore builds only the closest honest personal consolation tool.
Keep it
Keeper
A consolation build is possible, but the paid product's decisive value sits outside a solo rebuild. For Keeper, manage a local encrypted credential vault and secure notes. The hard boundary is audits, enterprise controls, autofill, monitoring, recovery, and support, plus security assurance, infrastructure, and trust.
Keep it
NordPass
A consolation build is possible, but the paid product's decisive value sits outside a solo rebuild. For NordPass, build a local encrypted vault and simple autofill without claiming audited security. The hard boundary is security operations, cross-platform apps, breach scanning, recovery, and support, plus security assurance, infrastructure, and trust.
Keep it
Optery
A consolation build is possible, but the paid product's decisive value sits outside a solo rebuild. For Optery, record discovered public-profile pages and guide the user through legitimate opt-outs. The hard boundary is proprietary scanning coverage, screenshots, automated removals, human review, and monitoring, plus security assurance, infrastructure, and trust.
Keep it
RoboForm
A consolation build is possible, but the paid product's decisive value sits outside a solo rebuild. For RoboForm, build a local password vault and form filler with a deliberately narrow field set. The hard boundary is decades of form compatibility, browser extensions, sync, recovery, and support, plus security assurance, infrastructure, and trust.
Keep it
DeleteMe
A consolation build is possible, but the paid product's decisive value sits outside a solo rebuild. For DeleteMe, maintain a manual data-broker checklist and evidence log for user-driven opt-outs. The hard boundary is broker coverage, repeated submissions, identity verification, human operations, and legal processes, plus security assurance, infrastructure, and trust.
Keep it
Qooling
You can absolutely build a register: incidents in, corrective actions out, documents with version numbers, a dashboard that looks convincing. What you cannot build in a session is the thing anyone actually buys, which is an evidence trail an external ISO auditor will accept without argument, plus a mobile flow that a warehouse worker will actually use to report a near miss. Compliance software lives or dies on immutable audit logs, controlled document approval with signatures, retention rules and the fact that the vendor, not you, is the one explaining the system during a certification audit. A personal replacement also makes little sense here: this is inherently multi-user, and the value appears only when an entire site logs into it. Build the register if you want to understand your own processes; do not put your certification on top of it.
Keep it
Aura
Do not mistake the interface for the product. Aura's durable value is security, infrastructure, trust, which a solo one-shot build cannot reproduce responsibly. The prompt therefore builds only the closest honest personal consolation tool.
Keep it
Incogni
A consolation build is possible, but the paid product's decisive value sits outside a solo rebuild. For Incogni, track manual data-removal requests and reminders without impersonating the user or bypassing identity checks. The hard boundary is broker network, legal authorization, repeated removals, support, and operational scale, plus security assurance, infrastructure, and trust.
Keep it
Surfshark
Do not mistake the interface for the product. Surfshark's durable value is security, infrastructure, trust, which a solo one-shot build cannot reproduce responsibly. The prompt therefore builds only the closest honest personal consolation tool.