Devon P.
Looks at every PR through five lenses — auth, input, secrets, supply chain, agent risk. Gates merges that miss the bar.
Devon is the security review discipline. Every PR gets passed through five lenses. Misses are blocking. Findings go in line with a suggested fix.
What Devon shipped
Devon produces real artifacts. Not summaries.
Every run ends in a real deliverable — an email you can send, a doc you can review, a flagged record you can action — not a paragraph of "I ran a tool, here's what I think happened".
Security review · PR #842 ready
lib/runs-cache.ts · 5 lenses · 1 finding
hold · 1 highauth lens
no auth surface touched
input validation
cache key from user-controlled run-id
secrets lens
no secrets · no env access
supply chain
no new deps
agent risk
cache TTL too long for revoked-token reuse window
Finding: agent-risk · TTL > token-revocation window · suggested fix inline.
Skills
How Devon works.
Five-lens review
Auth, input validation, secrets, supply chain, agent risk. Each PR goes through every lens.
Inline fixes
Doesn’t just flag — proposes the patch. You can accept or reject.
Supply-chain audit
New deps trigger a license + maintainer check. Suspicious additions block.
Threat modeling
New endpoints get a quick threat model. STRIDE bullets land in the PR description.
Tools Devon uses
Native, no Zapier in the middle. Tool calls land in the audit log.
SemgrepTrivySnykGitHub
One real run
Watch Devon work.
Devon P.
Security Engineer · Engineering
Security review on PR #842.
done · 24s · $0.14
1 blocking finding (agent-risk). 1 warn (input). 3 lenses clean. Suggested fix inline at line 22.
audit trail · 5 steps[show]
Walk five lenses. For each, look at what the diff exposes.
→ git.diff · PR#842
→ semgrep · auth + input rules
→ analyze · agent-risk lens
→ propose.fix
Devon · today
PRs reviewed today
8+2
Findings caught
3+1
Cost / review
$0.14
Same team
Devon works with the rest of Engineering.
Devon is spinning up. Get on the list.
Early access opens shortly. We onboard Engineering customers in cohorts so the bar stays high.