Introducing Code Scans | Devin

Today we’re introducing Code Scans: a brand new method to flip broad engineering objectives into concrete enhancements throughout your codebase. Tell Devin what you need to obtain, and it helps you examine what wants to vary, consider the findings, and switch them into pull requests.

Many engineering duties begin with a selected change. Others begin with an consequence:

• Improve website positioning
• Reduce upkeep overhead
• Make your utility compile quicker

These objectives typically keep on the backlog as a result of step one alone is a considerable venture: investigating the codebase to determine the place to start out. Additionally, figuring out the alternatives is barely half the work — somebody nonetheless has to implement the modifications, and lots of of them.

Code Scans helps with each.

Powered by Agentic MapReduce, the structure we constructed for Devin Security Swarm, Code Scans breaks giant investigations into targeted batches, distributes them throughout parallel brokers, and synthesizes their findings into one report. Devin then turns its findings into PRs able to assessment.

Teams testing Code Scans forward of launch are already seeing outcomes:

Code Scans had a big affect on the issues we care most about: software program high quality, bug fixes, stability, efficiency, and compliance, together with safety and privateness. With an estimated 96% PR merge charge throughout a number of repos, we estimate we have saved over 700 engineering hours in our brief testing timeframe.

PR merge charge

96%

Engineering hours saved

700+

To get began, sort /scan within the Devin webapp, or learn the docs.

Start with a purpose

You don’t have to know which information to take a look at earlier than beginning a scan. Instead, you outline what you’re searching for, and Devin works with you to show that purpose right into a concrete codebase investigation.

For instance:

Find unused code in our net app. Exclude generated information and take a look at fixtures, and test for oblique references earlier than recommending a removing.

You also can convey your personal standards: a crew’s coding requirements, an accessibility guidelines, or necessities for an upcoming migration. Devin helps set up what to examine, what to skip, and what ought to depend as a discovering.

Once you affirm the scope and settings, Devin runs the investigation and brings again a listing of findings ordered by precedence. From there, you’ll be able to examine the proof, focus on the outcomes with Devin, and ask it to open PRs for the problems you need to handle.

Improve Rust compilation time

We requested Code Scans to hurry up compilation within the Dioxus repository. Devin recognized alternatives to streamline dependencies and construct configuration, together with making heavyweight CLI options opt-in moderately than compiling them by default. After making use of the modifications regionally, clear debug construct time dropped from 58.6 seconds to 21.0 seconds—a 64% discount throughout the 22 workspace crates examined.

Scan findings

dioxus · compile-time scan

1. Default mounted characteristic forces web-sys/js-sys/wasm-bindgen (and serialize forces serde) onto each non-web renderer

   The default characteristic set allows mounted, which prompts the heavyweight non-compulsory web-sys dependency (and transitively js-sys + wasm-bindgen) — but these bindings are…

2. Oversized foundational crate: steady generated aspect/attribute tables bundled with risky logic causes full re-expansion and downstream recompiles

   dioxus-html is a foundational crate that each renderer is dependent upon, and it bundles its huge, near-static generated aspect/attribute API (components.rs, global_attributes.rs)…

3. builder_constructors! aspect desk is the html crate’s dominant compile price (~112 components, ~112 per-element proc-macro invocations, duplicated hot-reload traversal)

   The single builder_constructors! invocation is the html crate’s dominant compile-time price. It expands 112 HTML/SVG components, every right into a unit struct, TAG_NAME/NAME_SPACE…

4. cargo-generate compiled unconditionally in dioxus-cli although used solely by dx create

   cargo-generate is a non-optional dependency used solely by the dx create/dx init scaffolding path, nevertheless it drags in git2/libgit2-sys (a local C library construct), liquid templating…

5. dioxus-ssr pulls tokio “full” (default-on) however solely makes use of fs + io-util

   dioxus-ssr declares tokio = { model = “1.28”, options = [“full”], non-compulsory = true }, however the crate makes use of tokio in precisely one module (incremental.rs) and solely touches tokio::fs and…

website positioning Optimization

We ran a scan for website positioning points throughout devin.ai and cognition.com. It surfaced 44 findings throughout the 2 repositories, and we shipped fixes over the next days. Comparing Ahrefs crawls earlier than and after:

• Ahrefs well being rating elevated from 87 to 92 on devin.ai.
• Slow pages decreased by 73% on devin.ai.
• Missing picture alt textual content was eradicated on cognition.com.

Scan findings

devin.ai + cognition.com · website positioning scan

1. Customer case-study pages emit relative og:picture / twitter:picture / JSON-LD i…

   Every buyer case-study web page (/clients/) units its Open Graph picture, Twitter picture, and Article JSON-LD picture to the uncooked frontmatter.ogimagePath worth, which is a root-relative path with no area and no main slash. Open Graph / Twitter Card spec and schema.org require absolute URLs, so previews and the Article rich-result picture break.

   devin-website

2. Redirect chain /sources/college → /college → exterior drops a hop on a…

   vercel.json defines /sources/college -> /college and, individually, /college -> https://learn.devinenterprise.com. Because the primary redirect targets one other redirect supply, requests to /sources/college traverse a two-hop 301 chain as an alternative of going straight to the ultimate vacation spot. Ahrefs confirms /sources/college has 157 stay backlinks (22 referring domains).

   devin-website

3. Homepage og:url resolves to non-canonical /index (mismatches canonical https:…

   The root structure units openGraph.url: ‘./’ on each web page. This holds for sub-routes however is fake for the homepage: Next resolves ./ for the foundation route towards pathname /index, so the served homepage emits og:url = https://cognition.com/index whereas its canonical hyperlink tag is https://cognition.com.

   cognition-marketing-website

4. Terminal structure omits the JSON-LD structured knowledge each base/desktop web page emits

   The _terminalLayout head assembles title/description/canonical/OG/hreflang however emits no JSON-LD, not like _baseLayout and _desktopLayout which each ship a default SoftwareApplication block. Its customers /cli (the Devin CLI product web page) and /auto-triage are each indexable central product surfaces.

   devin-website

5. Ended occasion stays indexable with meta description promoting a stay webinar

   The whats-new-in-devin-06-24-26 occasion web page declares on-page that the occasion is over (‘This occasion has ended’, ‘Event ended’, ‘Registration closed’), but its metadata accommodates no robots: {index:false} and its meta/OG descriptions nonetheless promote the webinar as stay and upcoming. So an expired web page stays indexable whereas its search snippet promotes a previous occasion as if registration have been open.

   cognition-marketing-website

Agentic MapReduce

Code Scans is constructed on prime of Agentic MapReduce, the structure we constructed for Devin Security Swarm, to make codebase-wide investigations sensible. It works in 4 phases:

1. Plan. Devin research your repository and defines guidelines for figuring out code related to your purpose.
2. Shard. Those guidelines run throughout the codebase, and the matching code is split into targeted batches.
3. Map. Parallel Devin brokers examine every batch, studying surrounding code as wanted and reporting their findings.
4. Reduce. A ultimate agent combines the findings, removes duplicates, and prioritizes the outcomes into one report.

Agentic MapReduce Pipeline

dead-code scan instance

1. 1Plan
2. 2Shard
3. 3Map
4. 4Reduce

1. Plan

Agentic

Devin research the repository and defines guidelines for the code related to your purpose — right here, symbols, modules, and dependencies which will not be used.

exports with no importersunreferenced modulesunused dependenciesstale characteristic flags

This retains every agent’s context targeted and directs the reasoning funds towards related code moderately than repeated looking. This structure additionally ensures completeness: each chosen batch have to be processed. Code Scans brings that very same strategy past safety to the engineering objectives you outline.

What would you scan for?

Code Scans can examine a variety of engineering questions, utilizing your codebase’s conventions and the factors you present. Here are some examples:

Scan	Goal
Performance	Find sluggish paths, redundant computation, and missed caching alternatives that would make your utility quicker.
Database queries	Look for N+1 queries, pointless spherical journeys, unbounded reads, and different inefficient or unreliable data-access patterns.
Test protection	Identify necessary flows, edge circumstances, and failure paths that aren’t lined by exams.
Dead code	Find unused capabilities, modules, dependencies, and out of date characteristic flags, with proof for what can safely be eliminated.
Code high quality	Look for duplicated logic, pointless complexity, higher abstraction alternatives, and patterns that violate your crew’s coding requirements.
Cleanup	Identify redundant abstractions, extreme boilerplate, and code that may be simplified with out altering conduct.
Telemetry	Find gaps in logging, metrics, and tracing that make failures troublesome to diagnose or necessary conduct troublesome to measure.
Accessibility	Look for lacking labels, damaged keyboard interactions, and different gaps towards the WCAG standards you specify.
Compliance	Investigate sensitive-data dealing with, audit trails, and retention logic towards your group’s regulatory necessities and insurance policies.
Migration planning	Trace current dependencies, end-to-end flows, and enterprise logic to supply a plan for an upcoming migration.
website positioning Optimization	Find code-level points affecting search visibility, together with lacking or duplicated metadata, incorrect canonical URLs, indexing directives, and gaps in sitemaps or structured knowledge.
Your personal	Define a sample you need Devin to search for all through the codebase.

The most helpful scan may come from a query your crew has been pushing aside as a result of answering it meant wanting in every single place.

Type /scan in your Devin session, specify what you need to examine, construct the scope collectively, and begin optimizing your codebase as we speak.

Try Code Scans at devin.ai and be taught extra within the Code Scans docs.