Skip to main content
Stay ahead of the OWASP Top 10. This scheduled automation runs a targeted audit of your codebase against the current OWASP Top 10 web application security risks — missing security headers, CSRF protection gaps, SQL injection surfaces, weak authentication patterns — then files tickets and opens hardening PRs.

Use this template

Open OWASP Security Hardening in Devin and create the automation with the default configuration. You can customize it before saving.

​
What this automation does

The OWASP Top 10 is the industry baseline for web application security, but most teams don’t have the time to audit against it regularly. This automation does it for you: weekly scans, prioritized findings mapped to each OWASP category, and actionable fix PRs for the issues Devin can safely remediate.

​
How it works

Trigger: Schedule event — recurring
  • Event: schedule:recurring
    • Conditions:
      • rrule matches FREQ=WEEKLY;BYDAY=MO;BYHOUR=9;BYMINUTE=0
What Devin does: Starts a session with full event context, executes the prompt below, and (optionally) notifies you on failure.

​
Prerequisites

​
Example prompt

The template ships with this prompt. You can edit it after clicking Use template, or leave it as-is.

​
Setting it up

  1. Open Automations → Templates in Devin.
  2. Click OWASP Security Hardening. The create page opens with this template pre-filled.
  3. Connect any required integrations and install MCP servers if you haven’t already.
  4. Replace any placeholder values in the trigger conditions (for example, swap your-org/your-repo for your actual repo).
  5. Review the prompt and adjust it for your team’s language, conventions, and guardrails.
  6. Click Create automation.
Most automation templates include suggested ACU and invocation limits to bound cost during early rollout. Keep them as-is until you’re confident in the automation’s behavior, then raise them to fit your workload.

​
When to use this template

  • Pre-SOC 2, ISO 27001, or HIPAA audit preparation
  • Customer security review response
  • Ongoing security posture maintenance
  • Proactive hardening before exposure to untrusted traffic

​
Customization ideas

  • Focus on specific OWASP categories (e.g. A01, A03, A07)
  • Scope to specific repos or services (public-facing vs internal)
  • Cross-reference with penetration test findings
  • Integrate with your compliance platform for evidence collection

​
See also