Head to head
Devin vs Lovable
Comparing 9 documented Devin incidents against 3 for Lovable.
What these records show
Devin has the lower average severity among the incidents collected here (2.4 vs 8.7 for Devin and Lovable, from 9 and 3 incidents). These records can't establish which agent is safer: counts reflect how widely each is used and how often people report failures, not a failure rate.
| Metric | Devin | Lovable |
|---|---|---|
| Documented incidents | 9 | 3 |
| Average severity | 2.4 | 8.7 |
| Critical | 0 | 2 |
| High | 0 | 1 |
| Source checked | 9 | 1 |
Severity at a glance
Failure modes
The incidents behind these numbers
Devin
5.0Devin replaced entire medical website with unrelated renal care site3.0Devin CI workflow caused 836-comment spam storm on single PR2.0Devin built 13,600-line app with build failure instead of lean campaign dashboard2.0Devin PR broke ledger list API and created buckets on deleted resources2.0Devin repeatedly submitted identical docs PRs that kept getting rejected
Lovable
9.0A broken object-level authorization bug let any free Lovable account pull other users' source code, Supabase credentials and AI chat histories for 48 days before Lovable fixed it9.0Lovable-generated apps shipped without adequate Supabase row-level security, leaving databases readable and writable by anyone (CVE-2025-48757)8.0A security researcher found 16 vulnerabilities — including inverted access-control logic — in a Lovable-generated EdTech app, exposing 18,697 users' records and letting anyone delete accounts or grade exams