Devin devin.ai ↗

Lock Down Account Authentication and SSO

For anything beyond a single-developer Pro account, use the Enterprise plan and route logins through your IdP. Devin supports SAML SSO, OIDC, Okta, Azure AD/Entra ID, SCIM-style IdP group sync.

Tip: enforce SSO-only login (disable password fallback); require MFA at the IdP (Devin itself relies on the IdP for MFA); map IdP groups to Devin's default roles (Admin, Member, DeepWiki Only) or custom roles. Configure IP Access Lists (PUT /v3/enterprise/ip-access-list) — note the PUT replaces the entire list, document IPs externally first.

Minimize GitHub OAuth Scope

The GitHub App is the single biggest blast-radius surface. Devin's default install requests read/write on contents, PRs, issues, checks, commit statuses, discussions, projects, workflows — full contributor access.

Tip: during install choose "Only select repositories", never "All repositories"; enforce branch protection on main / release branches (required reviewers, required checks, no force-push); require signed commits; use CODEOWNERS on .github/, infra/, .agents/; allowlist Devin's published egress IPs (100.20.50.251, 44.238.19.62, 52.10.84.81) in your GitHub org IP allowlist.

Understand (But Don't Rely On) Workspace VM Isolation

Cognition built microVM-per-session isolation — each Devin gets its own kernel, filesystem, network namespace; VM destroyed when session ends. What you still control: Snapshots (review like Dockerfiles — anything in snapshot is in every future session), machine size / concurrency caps, network egress (Cognition's default is allowlist with deny-by-default but Devin can still fetch arbitrary URLs).

Tip: if you handle regulated data, the Enterprise tier offers single-tenant VPC deployment with AWS PrivateLink or IPSec — use it instead of multi-tenant cloud.

Treat Knowledge and Skills as Code

Devin's Knowledge (org-wide notes auto-recalled by trigger description) and Skills/Procedures (SKILL.md files in .agents/skills/, .cognition/skills/) are prompt-injection vectors with persistence. A malicious or sloppy Knowledge entry executes on every future session that matches its trigger.

Setting: restrict who can create org-level Knowledge via custom roles (ManageKnowledge permission); store all Skills in-repo under .agents/skills/<name>/SKILL.md and require CODEOWNERS review on those paths; use the allowed-tools: YAML frontmatter to restrict procedures to read-only or specific tools.

Tip: set triggers: ["user"] on sensitive skills so Devin won't auto-activate them from indirect prompts; audit Skills' !`command` substitution and $ARGUMENTS — these execute in the VM.

Scope the Slack Integration Tightly

The Slack app requests nine permission groups including channels:history, groups:history, im:history, files:read/write, users:read.email. Anyone in a channel where the bot is present can @Devin and burn ACUs.

Tip: invite @Devin only to specific channels (#devin-requests, #eng-triage) — never the workspace-wide default channel; disable or scope Auto-triage which monitors channels and auto-spawns sessions; block external/guest users from channels where Devin is present (Slack Connect guest = indirect-prompt-injection path).

Set ACU and Cost Limits Aggressively

Devin's business model is ACU-based (Agent Compute Units) on top of plan quotas with pay-as-you-go overage. A confused or jailbroken Devin running in a while-true loop is a billing event.

Tip: restrict the RunDevinSessions permission to only the roles that need it; restrict ManageApiKeys so service users cannot be created broadly; for automation (auto-triage, CI-triggered, scheduled snapshots) put a manual approval gate in front so a malformed issue title cannot spawn 50 sessions.

Use Devin Secrets Correctly — Never Paste Credentials in Chat

Devin Secrets encrypted at rest. Three scopes: organization (admin manage), personal (creator only), repo/session-specific.

Tip: never paste API keys, tokens, passwords directly into Devin chat — always reference via Secrets UI so masked in logs and screenshots; create a dedicated [email protected] machine identity per third-party service Devin needs (GitHub bot, Linear API key, AWS IAM with least-privilege); document Secrets in Notes with owner, scope, expiration; rotate quarterly; audit secrets:created/secrets:revoked events.

Plan for Prompt Injection from Issues, PRs, Web Pages

This is Devin's most-exploited real vulnerability class. Johann Rehberger has publicly demonstrated: indirect injection from a web page Devin browsed → Devin exposes a random VM port to the internet; web-content injection → Devin downloads malware into the VM; crafted issue/PR content → Devin leaks secrets out of the workspace.

Tip: never let Devin auto-merge (branch protection + required human review is the only reliable backstop); treat any session that touched external URLs as tainted; don't put production credentials in the same session that browses the open web; for auto-triage, sanitize the issue body before it reaches Devin; watch the live session — if the screen does something unexpected, pause immediately.

Inventory Integrations and MCP Servers

The Enterprise audit-log catalog references GitHub, GitLab, Azure DevOps, Bitbucket, Linear, Jira, Slack, and MCP servers as connectable surfaces. Each one is a new credential and a new injection channel.

Tip: maintain an integrations allowlist — admins approve each integration before enable; restrict ManageMcpServers and ManageIntegrations permissions to platform admins via custom roles; vet third-party MCP servers the same way you'd vet a VS Code extension; disable integrations you don't actively use — every dormant OAuth grant is a credential someone could revive.

Turn On Audit Logs and Review Them

Audit logs (GET /v3/enterprise/audit-logs) capture 100+ event types: logins, role changes, integration installs, secrets create/revoke, knowledge edits, MCP server changes, automation triggers, AI guardrail violations.

Tip: enable a service user with cog_ prefix and ManageEnterpriseSettings scoped only to audit-log read; pull logs nightly into SIEM (Datadog/Splunk/Panther) — retention windows are limited to ~100 days per query; alert on new integration installed, role changed to Admin, secrets revealed/edited at org scope, IP access list modified, SSO config changed, bursts of session creation outside business hours.