> ## Documentation Index
> Fetch the complete documentation index at: https://docs.devin.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Devin Code Scans

> Use Devin Code Scans to find performance, test coverage, dead code, accessibility, and other issues across your repositories, then fix them with Devin

A code scan is a Devin session, and the child sessions it starts, that reads one or more repositories, reports **findings**, and can fix them through pull requests. Security scans are covered in [Security Swarm](/work-with-devin/security-swarm). This page covers the other scan types.

<Accordion title="Prerequisites">
  To run a scan:

  * You need the **Use code scans** permission and permission to use Devin sessions. See [Access and permissions](/work-with-devin/security-swarm#access-and-permissions).
  * Your organization must have access to the repository you want to scan.
</Accordion>

## Start a scan with `/scan`

1. In the composer, type `/scan` followed by what you want to find, and mention the repositories to scan. For example: `/scan find N+1 queries in @acme/api`. Repositories you've selected in the composer are included too.
2. Send the message. Devin starts a new session to set up the scan and opens it. If you sent `/scan` on its own, Devin suggests example scans, such as finding slow database queries or unused code, and asks what you want to find.
3. Devin chooses the scan type from your request and states it in one line, for example that it will set up a custom scan that only looks for camelCase variable names. Reply if you want something different.
4. Devin shows a **Code scan setup** card. Confirm the **Repositories** to scan, and optionally add guidance under **What should the scan focus on?**. If you didn't mention a repository, Devin preselects the one you've worked in most, based on your recent pull requests.
5. Click **Start scan**. Devin creates the scan only after you submit the card, then shares a link to the scan's session. Click **Dismiss** to cancel setup instead.

You don't need to pick a scan type or configure the scan yourself. Requests that cover a whole area, such as a performance scan of a repository, use the matching [scan type](#scan-types). Narrower or different objectives, such as finding memory leaks, use a **Custom** scan focused on what you described.

<video autoPlay muted loop playsInline className="w-full aspect-video" src="https://mintcdn.com/cognitionai/C44xaWXfrf74E4c0/images/work-with-devin/code-scans/code-scans-walkthrough.mp4?fit=max&auto=format&n=C44xaWXfrf74E4c0&q=85&s=8c69208be93267cd470d3591447f3c5f" data-path="images/work-with-devin/code-scans/code-scans-walkthrough.mp4" />

When a non-security scan finishes, Devin sends you a Slack direct message summarizing the findings, unless you asked for a different notification or none. Slack messages require your organization's Slack integration to let sessions send direct messages.

<Note>Non-security scans run unattended at normal effort. Effort choices and interactive mode, where Devin pauses so you can review a threat model before investigating, are only available for [security scans](/work-with-devin/security-swarm#interactive-mode).</Note>

## Scan types

| Scan type            | What it looks for                                                                                                                                |
| -------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------ |
| **Performance**      | Performance issues and opportunities to make your code faster and more efficient.                                                                |
| **Database queries** | Problems in the places your code queries its data stores: inefficient, incorrect, unsafe, or unreliable queries.                                 |
| **Test coverage**    | Flows and components that aren't covered by tests.                                                                                               |
| **Dead code**        | Code nothing reaches anymore: unused functions, modules, flags, and dependencies that are safe to remove.                                        |
| **Code quality**     | Maintainability problems that make the code harder to read, change, and keep correct.                                                            |
| **Cleanup**          | Messy, redundant, and over-built code that can be cleaned up without changing behavior.                                                          |
| **Telemetry**        | Places that need telemetry or tracking instrumentation.                                                                                          |
| **Accessibility**    | Frontend code that doesn't meet accessibility guidelines (WCAG), such as missing labels, broken keyboard access, and low contrast.               |
| **Compliance**       | Gaps against the regulations, standards, and policies the scan is set up to check, such as sensitive-data handling, audit trails, and retention. |
| **Migration docs**   | Traces your code's end-to-end flows and business logic and produces migration-ready documentation with diagrams.                                 |
| **Custom**           | Anything else you describe, such as places that log personal data or a naming convention your team wants to enforce.                             |

For vulnerabilities and attack surfaces, use a [Security Swarm](/work-with-devin/security-swarm) scan.

## Review and fix findings

Open the **Findings** tab in the session that started the scan, or in the scan's main session, to work through its findings. Open findings are grouped by stage:

* **Unassigned** — no remediation session has started.
* **Assigned** — a remediation session has started, but no pull request is open.
* **PR open** — a pull request for the finding is open.

For each finding, you can:

* **Assign to Devin** — start a Devin session that fixes the finding and opens a pull request. Use **Open session** to follow the work and **Open PR** to review the result.
* **Dismiss** — remove a finding that doesn't need action.

While a scan is running, the Findings tab in the scan's main session also offers **Pause scan**, **Resume scan**, and **Kill scan**. These controls require **Manage code scans**.

## Scale scanning

### Scan new commits

After a scan of any type completes, click **Scan new commits** in the Findings tab to start an incremental run that scans only the commits added since the scan's last completed run. The run uses the scan's existing configuration and adds its findings to the same scan. The button isn't shown while the scan is running or after it's archived, and it requires **Manage code scans**. If no new commits have landed, no run starts.

You can also ask Devin in a session to scan an existing scan's new commits.

### Automations

[Automations](/product-guides/automations) can run scans of any type on a schedule or in response to an event. Choose the **Code scan** agent type, then under **Scan**:

* Choose **Create a new scan** to start a fresh scan each time the automation fires. Pick the repositories, scan type, and profile. Non-security scan types require a [scan profile](/work-with-devin/security-swarm#scan-profiles) of the same type.
* Choose an existing scan to scan its new commits each time the automation fires. The scan must already have a completed run.

Scans started by automations run unattended. See [Start scans from Automations](/work-with-devin/security-swarm#start-scans-from-automations).

### API

The [Code Scans API](/api-reference/v3/code-scans/triggering-code-scans) starts scans, polls them, and reads findings without the web app. When you start a non-security scan through the API, you must pass a `profile_id` for a profile of that scan type; `scan_type` defaults to the profile's type. Scans started through the API are not interactive.

## Related pages

* [Security Swarm](/work-with-devin/security-swarm) — security scans, scan profiles, interactive mode, and code scan permissions.
* [Triggering Code Scans via the Devin API](/api-reference/v3/code-scans/triggering-code-scans) — the end-to-end API flow.
* [Automations](/product-guides/automations) — schedule and trigger scans.