Skip to main content
Close the gap between GitHub Security Advisories and your engineering workflow. This scheduled automation audits your repositories against the CVE database and GitHub’s own advisory feed, deduplicates findings, and creates prioritized tickets — so vulnerabilities don’t sit unacknowledged in the Security tab.

Use this template

Open Dependency Vulnerability Scanner in Devin and create the automation with the default configuration. You can customize it before saving.

​
What this automation does

Where the Security Vulnerability Scan template focuses on running scanners, this one focuses on acting on the output: sorting findings by severity, correlating with already-open tickets (to avoid duplicates), and producing actionable work with clear fix recommendations.

​
How it works

Trigger: Schedule event — recurring
  • Event: schedule:recurring
    • Conditions:
      • rrule matches FREQ=DAILY;BYHOUR=9;BYMINUTE=0
What Devin does: Starts a session with full event context, executes the prompt below, and (optionally) notifies you on failure.

​
Prerequisites

​
Example prompt

The template ships with this prompt. You can edit it after clicking Use template, or leave it as-is.

​
Setting it up

  1. Open Automations → Templates in Devin.
  2. Click Dependency Vulnerability Scanner. The create page opens with this template pre-filled.
  3. Connect any required integrations and install MCP servers if you haven’t already.
  4. Replace any placeholder values in the trigger conditions (for example, swap your-org/your-repo for your actual repo).
  5. Review the prompt and adjust it for your team’s language, conventions, and guardrails.
  6. Click Create automation.
Most automation templates include suggested ACU and invocation limits to bound cost during early rollout. Keep them as-is until you’re confident in the automation’s behavior, then raise them to fit your workload.

​
When to use this template

  • Security-focused teams needing ongoing dependency hygiene
  • Compliance programs requiring vulnerability ticketing
  • Reducing mean time to remediation (MTTR) for known CVEs
  • Multi-repo organizations with many languages and package managers

​
Customization ideas

  • Scope to specific repos or package ecosystems
  • Route critical vulnerabilities to a high-priority escalation channel
  • Integrate with your ticket system (Linear, Jira, GitHub Issues)
  • Combine with Security Vulnerability Scan for scan-and-fix coverage

​
See also