> ## Documentation Index
> Fetch the complete documentation index at: https://docs.devinenterprise.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Devin Security Connections

> Which Devin Security connections import findings and which write triage (dismiss, complete, reopen, priority) back to the source tool, with the limits of each.

## Supported connections

**Read** means findings are imported into a Devin Security board. **Write** means triage in Devin (dismiss, complete, reopen, priority) updates the matching record in the source; Notes list which actions are written where it is not all four. **Create** means findings from Devin's own scans are created as new records in the source.

| Connection | Read | Write | Create | Notes |
| - | - | - | - | - |
| **Linear** | Yes | Yes | Yes | Keeps workflow state and priority in sync; new issues go to the connection's team. |
| **Jira** | Yes | Yes | Yes | Jira Cloud only. Moves issues through the project's workflow and sets priority from the project's scheme; new issues go to the connection's project. Dismiss and complete use the same transition when the workflow has only one into Done, and a workflow with no matching transition leaves the issue unchanged. |
| **Snyk** | Yes | Yes | No | Dismiss adds a `wont-fix` ignore, reopen removes it. Complete writes nothing (Snyk closes issues on rescan). No severity write. |
| **Socket** | Yes | Yes | No | Dismiss / complete create an alert resolution, reopen deletes it. Applies to the package version across the Socket organization. No severity write. |
| **ArmorCode** | Yes | Yes | No | Dismiss → risk accepted, complete → mitigated, reopen, priority → severity. |
| **Wiz** | Yes | Yes | No | Dismiss → `REJECTED`, complete → `RESOLVED`, reopen → `OPEN`. Wiz accepts `RESOLVED` only for Threat Detection Issues. No severity write. Needs a service account with the scopes listed under [Wiz](#wiz). |
| **GitHub Advanced Security** | Yes | Not yet | Not yet | Code scanning, secret scanning and Dependabot alerts. |
| **SonarQube** | Not yet | Not yet | No | Issues and Security Hotspots. |
| **Veracode** | Yes | Yes | No | Static, Dynamic, Manual and SCA findings of one application. Dismiss proposes an `ACCEPTRISK` mitigation, which a Mitigation Approver still accepts in Veracode; reopen rejects that proposal (a mitigation made in Veracode itself is left alone). Complete writes nothing (Veracode closes flaws on rescan). No severity write. SCA findings are import only. |
| **Vanta** | Yes | No | Not yet | |
| **JFrog** | Yes | No | No | Violations from Xray watches. |
| **Black Duck** | Yes | Yes | No | Vulnerable components of one project version. Dismiss → `IGNORED`, complete → `REMEDIATION_COMPLETE`, reopen → `NEW` remediation status. No severity write. |
| **Zafran** | Yes | No | No | |
| **CSV** | Yes | No | No | One-time import. |
| **Custom** | Yes | No | No | Devin follows your instructions to pull findings from any API. |

## Wiz

Devin connects to Wiz as a service account, using OAuth client credentials against your tenant's GraphQL API. Create the service account in Wiz under **Settings → Service Accounts**, then give the connection:

* **GraphQL endpoint**: your tenant's API endpoint from **Settings → Tenant**, for example `https://api.us1.app.wiz.io/graphql`. Devin works out the token endpoint from it.
* **Client ID** and **Client secret**: the service account's credentials, each stored as an org secret.

### Scopes

Grant the service account these scopes:

| Used for | Scopes |
| - | - |
| Importing Issues | `read:issues`, `read:threat_issues` |
| Writing triage back | `write:issue_status`, `write:threat_issue_status`, `write:issue_ignore` |

Wiz checks `write:issue_ignore` when an Issue is dismissed and `write:threat_issue_status` when a Threat Detection Issue is completed. `write:issue_status` alone allows neither. A service account with only the read scopes still imports findings, but every write is refused.

### What is written

| In Devin | In Wiz |
| - | - |
| Dismiss | Status `REJECTED` with resolution reason `WONT_FIX` |
| Complete | Status `RESOLVED` with resolution reason `ISSUE_FIXED` |
| Reopen | Status `OPEN` |

Dismiss and complete also leave a note on the Issue naming the Devin ticket.

### Limits

* Wiz accepts `RESOLVED` only for Threat Detection Issues. Every other Issue type is resolved by Wiz itself when a rescan no longer finds the problem, so completing one in Devin leaves it open in Wiz.
* Severity is not written: a Wiz Issue takes its severity from its Control.
* When Wiz refuses a write, such as for a missing scope, Devin starts a session with the change it attempted and the error Wiz returned.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.