DevinWorkshop

GitHub only

Audit six repos with a Dynamic Workflow

A Dynamic Workflow runs one child session per repo to check for a deprecated package and missing rate limits, ranks the findings, and opens PRs only for confirmed ones.

Needs
GitHub · GitHub CLI
Starter
devin-demo-fanout-audit

Steps

  1. Enter your GitHub user or org. The links and the prompt on this page use it.
  2. Create your own copy of the starter repo. Open GitHub's new-repository page for devin-demo-fanout-audit, choose your account as the owner, keep the name devin-demo-fanout-audit, and click Create repository.
  3. Make sure Devin can access the new repo under Settings → Connections → GitHub.
  4. Clone your copy and publish the six services as their own repos. This needs the GitHub CLI, logged in: git clone https://github.com/<you>/devin-demo-fanout-audit && cd devin-demo-fanout-audit && scripts/publish-services.sh <you>
  5. Give Devin access to the six new acme-svc-* repos under Settings → Connections → GitHub.
  6. Start a session at app.devin.ai and paste the prompt below.

Prompt

Audit all six Acme microservices for two risks, using a Dynamic Workflow: fan out one child session per repo, collect structured findings, then rank them.

Repos: https://github.com/<you>/acme-svc-payments https://github.com/<you>/acme-svc-orders https://github.com/<you>/acme-svc-users https://github.com/<you>/acme-svc-notifications https://github.com/<you>/acme-svc-search https://github.com/<you>/acme-svc-inventory

Check each repo for:
1. Use of the deprecated `request` npm package (a real runtime dependency/import, not a comment).
2. Write endpoints (POST/PUT/PATCH/DELETE), especially auth and money-moving ones, that have no rate limiting.

Each child must cite file:line evidence and run the repo's tests. Return a ranked table (severity, repo, finding, evidence, confirmed yes/no). Open a fix PR (with tests passing) ONLY for confirmed findings; explicitly list repos you checked and found clean or false positives, and explain why.

What to watch

  • The parent session orchestrates while each child audits one repo.
  • Every finding cites a file and line.

You're done when

  • You get a ranked table of findings.
  • Fix PRs open only for confirmed findings.
  • Clean repos and false positives are listed with reasons.
Next labFix a production error