Both the free and paid tiers of lovable don't charge for security fixes, and before you can publish it requests you run security audits.

I've found doing this, and regularly asking "did you just make my system massively insecure" help keep it on its toes.

That said, I've seen a few "look what I just made.." that caused a double take.