An interesting detail missing here is that there are two types of scans: “quick scans” and “deep scans.” Quick scans run automatically whenever a user publishes a project, while deep scans must be triggered manually -- except for enterprise customers.
https://docs.lovable.dev/features/security#built-in-security...