What's your actual workflow for verifying AI-generated code before shipping it?

Been building Consile almost entirely with Lovable, and the thing I've found matters most isn't the AI generating code fast, it's having a real, repeatable process for verifying what it generates before it ships. Things like actually reproducing security findings against live endpoints instead of trusting a policy read, or independently confirming a claimed fix rather than taking "done" at face value.

Curious what others here have landed on. Do you have an actual verification process, or is it more ad hoc? What's caught you off guard that a quick glance wouldn't have?