Head to head
GitHub Copilot vs Lovable
Comparing 6 documented GitHub Copilot incidents against 3 for Lovable.
What these records show
GitHub Copilot has the lower average severity among the incidents collected here (7.3 vs 8.7 for GitHub Copilot and Lovable, from 6 and 3 incidents). These records can't establish which agent is safer: counts reflect how widely each is used and how often people report failures, not a failure rate.
| Metric | GitHub Copilot | Lovable |
|---|---|---|
| Documented incidents | 6 | 3 |
| Average severity | 7.3 | 8.7 |
| Critical | 0 | 2 |
| High | 5 | 1 |
| Source checked | 6 | 1 |
Severity at a glance
GitHub Copilot
7.3
high
Lovable
8.7
high
Failure modes
GitHub CopilotDistribution of failure modes across all documented incidents.
LovableDistribution of failure modes across all documented incidents.
The incidents behind these numbers
GitHub Copilot
8.0GitHub Copilot CLI ran arbitrary attacker commands via a nested bare git repository abusing core.fsmonitor (CVE-2026-45033)8.0GitHub Copilot suggested 2,702 valid secrets — 33% of extracted keys were real, live credentials8.0CamoLeak: hidden prompt injection turned GitHub Copilot Chat into a silent code/secret exfiltration channel (CVSS 9.6)8.0Rule Files Backdoor: hidden Unicode in config files made Copilot and Cursor emit malicious code7.0Copilot CLI's checkpoint restore ran git clean -fd and destroyed 1GB of evaluation data the agent never touched
Lovable
9.0A broken object-level authorization bug let any free Lovable account pull other users' source code, Supabase credentials and AI chat histories for 48 days before Lovable fixed it9.0Lovable-generated apps shipped without adequate Supabase row-level security, leaving databases readable and writable by anyone (CVE-2025-48757)8.0A security researcher found 16 vulnerabilities — including inverted access-control logic — in a Lovable-generated EdTech app, exposing 18,697 users' records and letting anyone delete accounts or grade exams