Head to head
Cline vs Lovable
Comparing 12 documented Cline incidents against 3 for Lovable.
What these records show
Cline has the lower average severity among the incidents collected here (4.3 vs 8.7 for Cline and Lovable, from 12 and 3 incidents). These records can't establish which agent is safer: counts reflect how widely each is used and how often people report failures, not a failure rate.
| Metric | Cline | Lovable |
|---|---|---|
| Documented incidents | 12 | 3 |
| Average severity | 4.3 | 8.7 |
| Critical | 1 | 2 |
| High | 1 | 1 |
| Source checked | 10 | 1 |
Severity at a glance
Failure modes
The incidents behind these numbers
Cline
9.0Clinejection: an AI issue-triage workflow enabled arbitrary code execution on the CI runner7.0Cline's run_commands mangled PowerShell/cmd quoting on a temp-folder cleanup, turning it into a drive-root `rmdir /s /q` that wiped ~1.5TB of a user's photos, videos, and documents (GitHub #14864)6.0Cline's hub daemon silently reverted workspace files to stale state, repeatedly erasing a gitignored .env.local and collapsing a node_modules folder from 588 entries to 2 (GitHub #14819)6.0Cline's tool-call JSON repair silently executed truncated write_file and terminal arguments as valid5.0Cline sessions marked "failed" kept burning tokens for 20+ hours, and FREE-labeled models billed credits anyway
Lovable
9.0A broken object-level authorization bug let any free Lovable account pull other users' source code, Supabase credentials and AI chat histories for 48 days before Lovable fixed it9.0Lovable-generated apps shipped without adequate Supabase row-level security, leaving databases readable and writable by anyone (CVE-2025-48757)8.0A security researcher found 16 vulnerabilities — including inverted access-control logic — in a Lovable-generated EdTech app, exposing 18,697 users' records and letting anyone delete accounts or grade exams