Scan code for business-logic and auth bypass flaws

A developer used Devin to split a codebase into parts, trace exploit paths across files, confirm issues in a sandbox, and open fix pull requests.

Done with Devin· Advanced

What they did
They had parallel Devin agents each review a different slice of the codebase. Each agent looked for business-logic mistakes, chained authorization bypasses, and ways an attack could move across services. Devin then merged those findings into complete attack paths, tested them in an isolated sandbox, and, after confirming a vulnerability, wrote a patch and opened a pull request for review.
How it went
On Cognition’s 50-vulnerability benchmark, Devin Security reached 72% recall at $90.23 per run. Claude Security scored 68% at $131.87, but this was a vendor benchmark rather than an independent one.
Tips
Use a threat model document to generate scan profiles when you have one. After the first full pass, focus later scans on changed code, and tune batch size to trade off depth against cost.

Try it yourself with Devin

Review [repo name] for business-logic errors and auth bypasses. Split the code into sections, inspect them in parallel, and look for attack chains that cross files or services. For each possible issue, try to reproduce it in an isolated sandbox and stop before any real-side effect. Before doing anything irreversible, pause and ask me to approve it. Return confirmed findings in priority order, then open a draft pull request with a separate fix for each one. Do not merge changes or use production systems.

Fill in the [brackets]. Agents can make mistakes, so review anything before it is sent, paid or deleted.

Read the original on cognition.com ↗

1 more report of this

Get 3 agent uses like this every morning

With the day's top AI news. Free, and one click to unsubscribe.