devlo runs an AI security review of your GitHub repositories daily or weekly. Each confirmed vulnerability becomes an issue, each safe fix a pull request, and you approve every merge.
Exploits now land the day a flaw is disclosed, and most teams take months to fix one. A daily scan with a ready fix turns months into days.
Three steps from scan to pull request. Merging stays yours.
The problems that matter, in any language.
A finding without a fix is just more work. When the fix is small and safe, devlo opens it as a short pull request in your repository's style. Bigger changes get a plan in the issue.
54%: In a 2026 study of 6,080 AI-written security patches, more than half failed to fix the flaw or added a new one. Every devlo fix is a pull request you review. (1Password Off-By-1 Labs, 2026: https://www.esecurityplanet.com/artificial-intelligence/1password-finds-ai-security-patches-fail-more-than-half-the-time)
SAST (static application security testing) tools match code against known patterns: fast and predictable. devlo reads the code. Most teams run both.
| Rule-based SAST | devlo security review | |
|---|---|---|
| How it finds problems | Rules and patterns per language | Reads the code, call path and config, in any language |
| What you get | A list to triage | One issue per confirmed finding, with evidence |
| Fixes | Suggestions, or none | A pull request for each safe fix |
| Noise | Every match, reachable or not | Only findings it can back with evidence |
| Setup | Rule packs and CI config | Connect GitHub, set scope, turn on |
| Who decides | Pass/fail checks in CI | Your team, on the pull request |
An AI model reads your code the way a security engineer would and reports each vulnerability with its file, line, impact and a proposed fix. devlo runs it on a schedule across your repositories and delivers the results as GitHub issues and pull requests.
SAST (static application security testing) tools match known patterns and report every match. devlo reads the code, reports only findings it can back with evidence, and opens a pull request for small, safe fixes. Most teams run both.
Yes, when the fix is small and safe: it pushes a branch and opens a pull request that closes the issue. Your team reviews and merges. devlo never merges on its own.
Connect GitHub, open Automations, and turn on the Security Scanner. Set its scope and schedule, daily or weekly, and use Test run for the first scan.
GitHub's dependency alerts and code scanning flag known vulnerable versions and code patterns. devlo reads the code for what patterns miss, such as missing permission checks. It backs each finding with evidence and opens a pull request when the fix is safe.
devlo opens an issue only when it can show the file, line, how an attacker reaches it, and the impact. It skips theoretical risks, test data, and generated or copied-in third-party code, and remembers past runs. You can add exceptions to its instructions.
Yes: API keys, tokens, passwords, private keys and connection strings in source, configuration and CI files. It reports the file and line, never the value, and puts the steps to rotate the secret in the issue.
No. devlo works on a temporary copy of your repository and deletes it when the run ends. It has zero data retention agreements with model providers and is SOC 2 Type II. Only results are kept.
Any model in devlo's picker; the scanner starts on a default that balances cost and depth. Each run uses credits, depending on repository size and model.
Any language on GitHub. devlo reads code rather than applying per-language rules, and covers large repositories over several runs.
Connect GitHub, turn on the scanner, and review the first fixes today.