Skip to main content
Corridor integrates with Devin to catch security vulnerabilities before code is committed. When configured, your Devin environment installs the Corridor CLI and a git pre-commit hook that scans staged changes and blocks commits containing security findings.

​
Prerequisites

  • A Corridor account with a team created
  • Owner role on your Corridor team
  • A Devin account with permission to edit environments and organization secrets
  • The repository imported into Corridor as a project

​
Setup

The order of these steps matters. Devin runs your environment configuration while it builds the snapshot, so the secret has to exist before you save the configuration.
1

Open the Long-Running Agents page in Corridor

In the Corridor dashboard, navigate to Governance > Long-Running Agents and click the Configuration tab.Select Devin from the agent options.
2

Open your Devin settings

Go to app.devin.ai/settings. On Devin Enterprise, use your own subdomain instead — https://<subdomain>.devinenterprise.com/settings.
3

Generate a Corridor API key

Back in the Corridor Configuration tab, enter a name for your key (for example, “Devin cloud agents”) and click Generate key.Copy the full API key that is displayed in the modal. Note that the key is only shown once.
4

Add the API key as an organization secret in Devin

In your Devin settings, open the Organization tab and add a secret:
  • Name: CORRIDOR_API_KEY
  • Value: the API key you copied — the key on its own, not CORRIDOR_API_KEY=<key>
Add this secret before you save the environment configuration in the next step.
5

Paste the setup snippet into your environment configuration

Copy the snippet shown in the Corridor Configuration timeline and paste it into your Devin environment configuration:
6

Build a snapshot

Devin runs the initialize step when it builds a machine snapshot, so nothing is installed until it does. If the environment already has a snapshot, rebuild it to pick this up.
Devin installs the Corridor CLI while building the snapshot, so the environment needs outbound network access. If your environment restricts network access, add these domains to the allowlist:
  • app.corridor.dev
  • github.com
  • release-assets.githubusercontent.com

​
How it works

Once configured, your Devin environment will:
  1. Install the Corridor CLI
  2. Install a git pre-commit hook
  3. Scan staged changes before each commit
  4. Block commits that contain security findings
The hook is installed once in the home directory rather than per repository, so it also covers repositories cloned after setup. Findings caught by the pre-commit scan appear in the Usage tab of the Long-Running Agents page, where you can review severity, affected files, and resolution status.

​
Keeping a snapshot current

Devin fetches the setup script while building the snapshot, not at the start of each session. A snapshot keeps the version of the script — and of the Corridor CLI — that was current on the day it was built. Rebuild the snapshot to pick up Corridor updates. Rotating the API key also needs a rebuild, because the token is written into the snapshot.

​
Managing API keys

You can view and revoke API keys in the Configuration tab under Team-Owned API Keys. Each key shows its name, creation date, and last used date. To rotate a key:
  1. Generate a new key in Corridor
  2. Update the CORRIDOR_API_KEY secret in your Devin organization settings
  3. Rebuild the environment’s snapshot so it picks up the new key
  4. Revoke the old key

​
Next steps

Guardrails

Configure the security rules that your agents enforce.

Findings

Learn how to review and resolve security findings.