Devin

Coding agent (cloud) · Cognition · 6/7 verified · Last checked 2026-10-16

Sessions run in isolated environments, with a single-tenant VPC option for enterprise. Secrets are encrypted and scoped to org, user, repo or session. Audit logs are exposed through enterprise API permissions.

Overall: B (2.33 avg, 6/7 controls verified)

Lock this down first

Scope secrets to the repo or session that needs them instead of the whole org.

Scorecard

Criterion	Rating	Notes
Permission granularity	2/3	API roles and permissions such as ViewAccountSessions and ManageAccountSessions.
Human approval gates	Unverified	Not confirmed in the docs we checked.
Sandboxing	2/3	Sessions run in isolated environments; single-tenant VPC for enterprise.
Secrets handling	3/3	Encrypted at rest; scoped to org, personal, repo or a single session.
Audit logs	2/3	Enterprise API has a ViewAccountAuditLogs permission.
Kill switch / interrupt	2/3	Archiving a session puts it to sleep. Available via API.
Network egress control	3/3	Security Profiles take a network allowlist; all other outbound traffic is blocked.

Unverified: Human approval gates. That means we could not confirm it in public docs, not that it is missing.

Sources

Vendor? Request a correction. We review corrections within 7 days.