Skip to main content
A code scan is a Devin session, and the child sessions it starts, that reads one or more repositories, reports findings, and can fix them through pull requests. Security scans are covered in Security Swarm. This page covers the other scan types.
To run a scan:
  • You need the Use code scans permission and permission to use Devin sessions. See Access and permissions.
  • Your organization must have access to the repository you want to scan.

​
Start a scan with /scan

  1. In the composer, type /scan followed by what you want to find, and mention the repositories to scan. For example: /scan find N+1 queries in @acme/api. Repositories you’ve selected in the composer are included too.
  2. Send the message. Devin starts a new session to set up the scan and opens it. If you sent /scan on its own, Devin suggests example scans, such as finding slow database queries or unused code, and asks what you want to find.
  3. Devin chooses the scan type from your request and states it in one line, for example that it will set up a custom scan that only looks for camelCase variable names. Reply if you want something different.
  4. Devin shows a Code scan setup card. Confirm the Repositories to scan, and optionally add guidance under What should the scan focus on?. If you didn’t mention a repository, Devin preselects the one you’ve worked in most, based on your recent pull requests.
  5. Click Start scan. Devin creates the scan only after you submit the card, then shares a link to the scan’s session. Click Dismiss to cancel setup instead.
You don’t need to pick a scan type or configure the scan yourself. Requests that cover a whole area, such as a performance scan of a repository, use the matching scan type. Narrower or different objectives, such as finding memory leaks, use a Custom scan focused on what you described. When a non-security scan finishes, Devin sends you a Slack direct message summarizing the findings, unless you asked for a different notification or none. Slack messages require your organization’s Slack integration to let sessions send direct messages.
Non-security scans run unattended at normal effort. Effort choices and interactive mode, where Devin pauses so you can review a threat model before investigating, are only available for security scans.

​
Scan types

For vulnerabilities and attack surfaces, use a Security Swarm scan.

​
Review and fix findings

Open the Findings tab in the session that started the scan, or in the scan’s main session, to work through its findings. Open findings are grouped by stage:
  • Unassigned — no remediation session has started.
  • Assigned — a remediation session has started, but no pull request is open.
  • PR open — a pull request for the finding is open.
For each finding, you can:
  • Assign to Devin — start a Devin session that fixes the finding and opens a pull request. Use Open session to follow the work and Open PR to review the result.
  • Dismiss — remove a finding that doesn’t need action.
While a scan is running, the Findings tab in the scan’s main session also offers Pause scan, Resume scan, and Kill scan. These controls require Manage code scans.

​
Scale scanning

​
Scan new commits

After a scan of any type completes, click Scan new commits in the Findings tab to start an incremental run that scans only the commits added since the scan’s last completed run. The run uses the scan’s existing configuration and adds its findings to the same scan. The button isn’t shown while the scan is running or after it’s archived, and it requires Manage code scans. If no new commits have landed, no run starts. You can also ask Devin in a session to scan an existing scan’s new commits.

​
Automations

Automations can run scans of any type on a schedule or in response to an event. Choose the Code scan agent type, then under Scan:
  • Choose Create a new scan to start a fresh scan each time the automation fires. Pick the repositories, scan type, and profile. Non-security scan types require a scan profile of the same type.
  • Choose an existing scan to scan its new commits each time the automation fires. The scan must already have a completed run.
Scans started by automations run unattended. See Start scans from Automations.

​
API

The Code Scans API starts scans, polls them, and reads findings without the web app. When you start a non-security scan through the API, you must pass a profile_id for a profile of that scan type; scan_type defaults to the profile’s type. Scans started through the API are not interactive.