ideally, the software produced should include the latest security patches.

If the model prefers a version of Ruby or node with an RCE, I guess you can burn tokens to teach the model how to avoid the introducing the vulnerability into your code?

That feels quite tedious and token inefficient..