> ## Documentation Index
> Fetch the complete documentation index at: https://docs.corridor.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Devin

> Set up Corridor with Devin to scan code for security vulnerabilities before every commit.

Corridor integrates with [Devin](https://devin.ai) to catch security vulnerabilities before code is committed. When configured, your Devin environment installs the Corridor CLI and a git pre-commit hook that scans staged changes and blocks commits containing security findings.

## Prerequisites

* A Corridor account with a team created
* **Owner** role on your Corridor team
* A Devin account with permission to edit environments and organization secrets
* The repository imported into Corridor as a project

## Setup

The order of these steps matters. Devin runs your environment configuration while it builds the snapshot, so the secret has to exist before you save the configuration.

<Steps>
  <Step title="Open the Long-Running Agents page in Corridor">
    In the [Corridor dashboard](https://app.corridor.dev), navigate to **Governance > Long-Running Agents** and click the **Configuration** tab.

    Select **Devin** from the agent options.
  </Step>

  <Step title="Open your Devin settings">
    Go to [app.devin.ai/settings](https://app.devin.ai/settings). On Devin Enterprise, use your own subdomain instead — `https://<subdomain>.devinenterprise.com/settings`.
  </Step>

  <Step title="Generate a Corridor API key">
    Back in the Corridor Configuration tab, enter a name for your key (for example, "Devin cloud agents") and click **Generate key**.

    Copy the full API key that is displayed in the modal. Note that the key is only shown once.
  </Step>

  <Step title="Add the API key as an organization secret in Devin">
    In your Devin settings, open the **Organization** tab and add a secret:

    * **Name:** `CORRIDOR_API_KEY`
    * **Value:** the API key you copied — the key on its own, not `CORRIDOR_API_KEY=<key>`

    Add this secret before you save the environment configuration in the next step.
  </Step>

  <Step title="Paste the setup snippet into your environment configuration">
    Copy the snippet shown in the Corridor Configuration timeline and paste it into your Devin environment configuration:

    ```yaml theme={null}
    initialize:
      - name: Install Corridor CLI + pre-commit security scan
        run: |
          curl -fsSL https://app.corridor.dev/cli/devin-setup.sh | sh
    ```
  </Step>

  <Step title="Build a snapshot">
    Devin runs the `initialize` step when it builds a machine snapshot, so nothing is installed until it does. If the environment already has a snapshot, rebuild it to pick this up.
  </Step>
</Steps>

<Note>
  Devin installs the Corridor CLI while building the snapshot, so the environment needs outbound network access. If your environment restricts network access, add these domains to the allowlist:

  * `app.corridor.dev`
  * `github.com`
  * `release-assets.githubusercontent.com`
</Note>

## How it works

Once configured, your Devin environment will:

1. Install the Corridor CLI
2. Install a git pre-commit hook
3. Scan staged changes before each commit
4. Block commits that contain security findings

The hook is installed once in the home directory rather than per repository, so it also covers repositories cloned after setup.

Findings caught by the pre-commit scan appear in the **Usage** tab of the Long-Running Agents page, where you can review severity, affected files, and resolution status.

## Keeping a snapshot current

Devin fetches the setup script while building the snapshot, not at the start of each session. A snapshot keeps the version of the script — and of the Corridor CLI — that was current on the day it was built.

Rebuild the snapshot to pick up Corridor updates. Rotating the API key also needs a rebuild, because the token is written into the snapshot.

## Managing API keys

You can view and revoke API keys in the **Configuration** tab under **Team-Owned API Keys**. Each key shows its name, creation date, and last used date.

To rotate a key:

1. Generate a new key in Corridor
2. Update the `CORRIDOR_API_KEY` secret in your Devin organization settings
3. Rebuild the environment's snapshot so it picks up the new key
4. Revoke the old key

## Next steps

<CardGroup cols={2}>
  <Card title="Guardrails" icon="shield-check" href="/features/guardrails">
    Configure the security rules that your agents enforce.
  </Card>

  <Card title="Findings" icon="magnifying-glass" href="/features/findings">
    Learn how to review and resolve security findings.
  </Card>
</CardGroup>