How Nubank refactors millions of lines of code to improve engineering efficiency with Devin

8x
engineering time efficiency gain
20x
cost savings
Vimeo

Overview

One of Nubank’s most critical, company-wide projects for 2023-2024 was a migration of their core ETL — an 8 year old, multi-million lines of code monolith — to sub-modules. To handle such a large refactor, their only option was a multi-year effort that distributed repetitive refactoring work across over one thousand of their engineers. With Devin, however, this changed: engineers were able to delegate Devin to handle their migrations and achieve a 12x efficiency improvement in terms of engineering hours saved, and over 20x cost savings. Among others, Data, Collections, and Risk business units verified and completed their migrations in weeks instead of months or years.

The Problem

Nubank was born into the tradition of centralized ETL FinServ architectures. To date, the monolith architecture had worked well for Nubank — it enabled the developer autonomy and flexibility that carried them through their hypergrowth phases. After 8 years, however, Nubank’s sheer volume of customer growth, as well as geographic and product expansion beyond their original credit card business, led to an entangled, behemoth ETL with countless cross-dependencies and no clear path to continuing to scale.

For Nubankers, business critical data transformations started taking increasingly long to run, with chains of dependencies as deep as 70 and insufficient formal agreements on who was responsible for maintaining what. As the company continued to grow, it became clear that the ETL would be a primary bottleneck to scale.

Nubank concluded that there was an urgent need to split up their monolithic ETL repository, amassing over 6 million lines of code, into smaller, more flexible sub-modules.

Nubank’s code migration was filled with the monotonous, repetitive work that engineers dread. Moving each data class implementation from one architecture to another while tracing imports correctly, performing multiple delicate refactoring steps, and accounting for any number of edge cases was highly tedious, even to do just once or twice. At Nubank’s scale, however, the total migration scope involved more than 1,000 engineers moving ~100,000 data class implementations over an expected timeline of 18 months.

In a world where engineering resources are scarce, such large-scale migrations and modernizations become massively expensive, time-consuming projects that distract from any engineering team’s core mission: building better products for customers. Unfortunately, this is the reality for many of the world’s largest organizations.

The Decision: an army of Devins to tackle subtasks in parallel

At project outset in 2023, Nubank had no choice but to rely on their engineers to perform code changes manually. Migrating one data class was a highly discretionary task, with multiple variations, edge cases, and ad hoc decision-making — far too complex to be scriptable, but high-volume enough to be a significant manual effort.

Within weeks of Devin’s launch, Nubank identified a clear opportunity to accelerate their refactor at a fraction of the engineering hours. Migration or large refactoring tasks are often fantastic projects for Devin: after investing a small, fixed cost to teach Devin how to approach sub-tasks, Devin can go and complete the migration autonomously. A human is kept in the loop just to manage the project and approve Devin’s changes.

The Solution: Custom ETL Migration Devin

A task of this magnitude, with the vast number of variations that it had, was a ripe opportunity for fine-tuning. The Nubank team helped to collect examples of previous migrations their engineers had done manually, some of which were fed to Devin for fine-tuning. The rest were used to create a benchmark evaluation set. Against this evaluation set, we observed a doubling of Devin’s task completion scores after fine-tuning, as well as a 4x improvement in task speed. Roughly 40 minutes per sub-task dropped to 10, which made the whole migration start to look much cheaper and less time-consuming, allowing the company to devote more energy to new business and new value creation instead.

Devin contributed to its own speed improvements by building itself classical tools and scripts it would later use on the most common, mechanical components of the migration. For instance, detecting the country extension of a data class (either ‘br’, ‘co’, or ‘mx’) based on its file path was a few-step process for each sub-task. Devin’s script automatically turned this into a single step executable — improvements from which added up immensely across all tens of thousands of sub-tasks.

There is also a compounding advantage on Devin’s learning. In the first weeks, it was common to see outstanding errors to fix, or small things Devin wasn’t sure how to solve. But as Devin saw more examples and gained familiarity with the task, it started to avoid rabbit holes more often and find faster solutions to previously-seen errors and edge cases. Much like a human engineer, we observed obvious speed and reliability improvements with every day Devin worked on the migration.

Results: Delivering an 8-12x faster migration, lifting a burden from every engineer, and slashing migration costs by 20x.

“Devin provided an easy way to reduce the number of engineering hours for the migration, in a way that was more stable and less prone to human error. Rather than engineers having to work across several files and complete an entire migration task 100%, they could just review Devin’s changes, make minor adjustments, then merge their PR”

Jose Carlos Castro, Senior Product Manager

8-12x efficiency gains This is calculated by comparing the typical engineering hours required to complete a data class migration task against the total engineering hours spent prompting and reviewing Devin’s work on the same task.
Over 20x cost savings on scope of the migration delegated to Devin This is calculated by comparing the cost of running Devin versus the hourly cost of an engineer completing that task. The significant savings are heavily driven by speed of task execution and cost effectiveness of Devin relative to human engineering time – it does not even consider the value captured by completing the entire project months ahead of schedule!
Fewer dreaded migration tasks for Nubank engineers
Devin for Security

Exploitation became cheap and fast.
Remediation didn't.

AI has compressed the vulnerability weaponization window from weeks to days. Scanners surface threats instantly, but remediation remains a manual bottleneck. Devin gives security and engineering teams scaled engineering capacity to take findings from triage to merged pull request — and Devin Review helps your engineers approve those changes with confidence.

From scanner finding to merged pull request

Give Devin a scanner finding, failing check, alert, or security ticket. Devin investigates the codebase, writes the fix, runs your tests and scanners, opens a review-ready PR, and iterates until checks pass.

  • Triggered from GitHub, Jira, Linear, Slack, scanners, or webhooks
  • Runs your tests, linters, and scanners until checks pass
  • Branch protections and required reviewers still apply
  • Audit-ready transcript for every session
Powered by Devin Enterprise

~70% of SonarQube, Fortify, and Veracode vulnerabilities resolved automatically

Itaú used Devin to clear a large vulnerability backlog across scanner findings, reducing remediation burden on engineering teams at scale.

Built for the controls your security team already trusts

  • SSO, SCIM, RBAC
  • Isolated, ephemeral execution
  • Human-controlled merge
  • Full audit trail
Why Devin for security

From finding to fix to review.

Devin is built to take on engineering work end to end. For security teams, that distinction matters. Remediation is not just generating a patch — it requires understanding the codebase, tracing the affected path, making the right change, validating that the fix works, and packaging the work for human review.

One workforce, three surfaces.

01

DeepWiki & Ask Devin

Understand the codebase before you touch it. DeepWiki generates living documentation for any repo. Ask Devin lets you query architecture, data flows, and permissions in plain language.

  • Understand unfamiliar repos before remediation begins
  • Living documentation that gives architecture visibility
  • Query what changed, where permissions are enforced, and how data moves
02

Devin

Assign Devin a finding, ticket, alert, or failing check. It investigates, writes the fix, runs your tests and scanners, and opens a PR — iterating until checks pass. Especially useful for the work security teams already know needs to happen, but rarely have the engineering capacity to complete.

  • Investigates the affected code path and root cause
  • Writes and validates the fix in an isolated environment
  • Opens a PR and iterates until CI passes
  • Gets smarter over time through Knowledge and Playbooks
03

Devin Review

Helps engineers review changes faster with codebase-aware context surfaced directly in the diff. Humans stay in control of what merges.

  • Organizes diffs and surfaces what matters
  • Flags bugs and risky patterns before the human reads
  • Answers reviewer questions grounded in the codebase
Common workflows

Three places to put Devin to work today.

Each workflow results in a reviewed, ready-to-merge PR. Devin does the investigation, the code changes, and the validation. Devin Review helps your team understand and approve the changes with confidence.

01

Reduce your security debt

Security debt grows when known issues are easy to identify but hard to safely fix. Devin helps teams turn that backlog into maintained code by taking on remediation work across vulnerabilities, dependency updates, insecure configurations, and repeated patterns across one or many repos. Run on demand or on a schedule, Devin helps security teams reduce backlog pressure while keeping fixes inside engineering's existing review process.

Workflows
  • Clear backlog — Address large backlogs across one or many repos, such as stored credentials, insecure configurations, missing best-practice updates, or outdated security patterns.

  • Routine work — Set Devin to run on a recurring basis to handle routine security maintenance, such as remediating CVEs, performing dependency bumps, or patching SAST/SCA findings.

  • Risk identification — Run Devin across your repos to find what your scanners miss: logic flaws, insecure patterns, missing auth checks, and chained low-severity CVEs that become critical in context.

02

Secure every release

Devin helps teams turn blocked PRs and failed checks into review-ready fixes by taking on remediation work across failing tests, insufficient coverage, dependency vulnerabilities, and CI/CD or security check failures. Triggered from PRs, CI/CD, or on demand, Devin helps teams keep releases moving while keeping fixes inside engineering's existing review and merge process.

Workflows
  • Investigate and fix failed checks — Add Devin to your CI/CD pipeline so that when a vulnerability is detected, Devin automatically generates a fix and pushes commits directly onto the original PR.

  • Launch readiness documentation — Automatically update developer guides, implementation notes, and launch checklists.

  • AI-assisted review before merge — Use Devin Review as a consistent first-pass reviewer on every PR. It inspects diffs with codebase context, flags bugs and risky patterns, and with Auto-Fix enabled can push fix commits directly to the branch.

03

Accelerate triage and response

Triage slows down when every alert, security finding, or incident requires a human to gather context before remediation can begin. Devin helps teams turn alerts into action by taking the first pass across security findings, vulnerability reports, and incident follow-up work.

Workflows
  • Findings remediation — Tag Devin in Slack, Jira, Linear, or GitHub to investigate and take a first pass at fixing a security finding.

  • Automated alert triage — Trigger Devin from your security scanners or SIEM-style workflows to investigate alerts, identify likely causes, and propose or implement remediation.

  • Post-incident follow through — After an incident, have Devin draft the first version of the postmortem, summarize contributing factors, and update relevant runbooks and documentation.

Enterprise

Built for enterprise security workflows

Devin runs inside the systems your team already controls — your source code, your CI, your developer tools, and your identity provider. Around it sit the guardrails your security team needs, from least-privilege access to a complete audit trail.

Infrastructure & isolation

  • Machine images configurable to match your developer environment
  • Each session runs in an ephemeral, fully isolated sandbox — destroyed when the session ends
  • Network egress runs through a domain allowlist that defaults to deny
  • Devin operates inside your existing proxies and network controls

Access & permissions

  • SAML SSO through your existing identity provider
  • Role-based access controls customizable to your enterprise
  • Per-repository access scoping
  • Per-tool access scoping
  • Least-privilege permissions by default

Control & audit

  • Devin opens pull requests; humans decide what merges
  • Branch protections and required reviewers apply exactly as configured
  • Every session produces a transcript exportable to your SIEM
  • Every commit, comment, and merge ties back to a specific session

FAQs

Have more questions? Talk to our team
to learn more.

  • Is Devin a replacement for our existing security tools?

    No. Devin does not replace your scanners, SIEM, EDR, or other detection systems — it acts on their output. Devin is the engineering execution layer that converts findings, alerts, and tickets into reviewed code changes inside your existing SDLC.

  • Does Devin change our SDLC controls?

    No. Devin operates within the controls you already have in place. Branch protections, required checks, reviewer approvals, merge policies, and release processes all continue to apply. Devin opens pull requests; humans decide what merges.

  • How does Devin handle data isolation and customer code?

    Each session runs in an ephemeral, fully isolated sandbox that is destroyed when the session ends. Credentials are short-lived and scoped, secrets are redacted from logs, and network egress can be restricted by domain allowlist.

  • How is Devin governed in an enterprise environment?

    Admins control who can use Devin, which repositories and tools it can access, and what actions it can take. Devin supports SAML SSO and SCIM through your identity provider, role-based access controls, per-repository and per-tool scoping, and least-privilege permissions by default.

  • Can Devin's activity be audited?

    Yes. Every session produces a transcript that can be exported to your SIEM. Every commit, comment, and merge ties back to a specific Devin session, so security and audit teams can trace any change end to end.

  • Can security and engineering teams trust the fixes Devin produces?

    Devin runs your tests, linters, scanners, and CI checks until they pass before opening a PR. Devin Review then provides a consistent first-pass review with codebase-aware context, flagging bugs and risky patterns before a human reviewer takes over. Humans always decide what merges.

Get started

Bring Devin into your security program.

Talk to our team