GitHub only
Find and fix security vulnerabilities
Devin demonstrates each vulnerability in a partner API with a failing test, fixes it, and keeps the test as a regression test.
Steps
- Enter your GitHub user or org. The links and the prompt on this page use it.
- Create your own copy of the starter repo. Open GitHub's new-repository page for devin-demo-security-exploits, choose your account as the owner, keep the name
devin-demo-security-exploits, and click Create repository. - Make sure Devin can access the new repo under Settings → Connections → GitHub.
- Start a session at app.devin.ai and paste the prompt below.
Prompt
Do an exploit-first security assessment of https://github.com/<you>/devin-demo-security-exploits (a partner-facing REST API with JWT auth).
For every vulnerability you suspect, prove it first: write a failing security test or a curl/script PoC against a locally running server that demonstrates real impact (e.g. forged token, cross-tenant data read, SQL injection, SSRF to an internal address). Rank findings by CVSS-style severity with evidence. Then fix each one, turning every PoC into a regression test that now passes, and open a single PR with a findings table (vuln, CWE, PoC, fix, test). Only report what you actually demonstrated.What to watch
- Each finding comes with a working proof of concept before any fix.
- Every proof of concept becomes a test that now passes.
You're done when
- There is one PR with a findings table (vulnerability, CWE, PoC, fix, test).
- It only reports what it actually demonstrated.