qualityclouds/state-of-ai-code-2026-

This repository is a published research dataset, not a piece of software. It reports the results of scanning 424 public projects that were built with AI code generators such as Lovable, Bolt, and v0, plus a control group of AI-assisted GitHub repos, totaling 21.6 million lines of code checked with one shared set of quality and security rules. The headline findings are stark. Fourteen percent of the scanned projects shipped with a leaked secret or hardcoded credential. Eighty seven percent of projects had at least one security finding, and only 56 of the 424 projects were completely clean on security. Projects built on Supabase, a backend-as-a-service platform, were far more likely to have security problems, at 98 percent versus 77 percent for projects not using it. The report ranks the four AI code generators by how many issues they produce per thousand lines of code, with a lower number being better. Copilot-assisted GitHub repos came out cleanest, followed by Bolt, then v0, then Lovable, which had both the highest issue density and the highest rate of security findings at 99 percent of its 183 sampled projects. The report is careful to note that Copilot-assisted code involved a human driving the architecture, so it is a control group rather than a fully comparable product, and that a large share of Lovable's higher numbers is explained by its heavier use of Supabase. The most common single issue found across the whole dataset was code that runs an operation without handling possible errors, appearing in 79 percent of all projects. Ten rules out of 295 total rules accounted for 88 percent of every issue found, so the report cautions readers not to read too much into the overall severity mix, since it mostly reflects a small number of very common rule triggers. The dataset itself, including the scan results and supporting charts, is released under a CC-BY-4.0 license, meaning anyone can reuse it freely as long as they credit the source.