Beyond the Scanner: Security Infrastructure for AI-Generated Software

AI-generated software changes the economics of security. At Lovable scale -- 60M+ generated apps, 1M+ new apps per week, and 700TB+ of code -- traditional DevSecOps assumptions fail: there may be no pull request, no expert developer, and no practical way to deeply scan or manually triage every change.

This talk shows how Lovable built a fleet-scale security scanning architecture for that reality. We combine deterministic scanners for cheap, broad, repeatable coverage with selectively invoked LLM reasoning for context, intent, reachability, and remediation. The interesting engineering is in the seam: deterministic scanners ground and gate the LLM; validation loops keep LLM findings honest; confidence buckets, re-scanning, and blast-radius controls make automated remediation safe enough to operate across millions of applications.

This is a practitioner talk about the infrastructure behind AI-scale security: scan scheduling, cost control, false-positive containment, validation, remediation, and the operating model for securing generated software when human review no longer scales.