Finding a vulnerability is the beginning. Across millions of AI-generated applications, security also means identifying affected projects, preparing reliable fixes, and getting those fixes into production.

Starting with a real malware campaign targeting customer projects, we’ll explore the infrastructure behind that process. We’ll cover security scanning and newly discovered TanStack vulnerabilities, then show how turbopuffer, regex indexes, and SCIP code intelligence help us ask security questions across large collections of code. We’ll explain how indexed evidence, deterministic checks, and targeted AI reasoning work together, and where deeper analysis remains necessary.

From there, we’ll explore the remediation system we’re building: preparing and validating patches, rebuilding applications, and reconciling deployments as users edit their code, jobs fail, and rollouts progress. The goal is to connect each finding to evidence that the repaired application is running.

Samuel Kelemen and Clément Pascutto from Lovable join Camilla Montonen from turbopuffer for a practical, optimistic look at securing AI-generated software. By connecting discovery, code intelligence, and the application lifecycle, we can turn what we learn from each vulnerability into faster repairs and stronger foundations for the next application.