Back to rankings

Windsurf: Devin Code Scans Get Auto-Scan Controls and a 1,000 Repository Cap

WindsurfView original changelog

Windsurf's Devin can now run multi-repo code scans across up to 1,000 repositories, doubled from 500, in both the UI and the API. Auto-scan can be switched on or off from a session's Findings tab, and the scan's schedule appears in the scan detail and the Devin MCP get_scan tool. When a threat-model scan finishes, Devin offers weekly or monthly incremental scans.

Key Takeaways

  • The multi-repo scan cap doubles from 500 to 1,000 repositories in both the UI and the API.
  • Auto-scan can be toggled on or off from the Findings tab of a session.
  • A scan's auto-scan schedule is shown in scan detail and in the Devin MCP get_scan tool, making it inspectable by people and agents.
  • After a threat-model scan finishes, Devin offers weekly or monthly incremental scans to keep coverage current.
  • The Findings tab's quick-wins card now shows a carousel of recommended findings' summaries.
  • The organization Findings page opens as a session tab with a "Chat with Findings" entry point for asking questions about results.

Bigger scans

Windsurf's Devin raised the per-scan repository limit for multi-repo code scans from 500 to 1,000. The new cap applies in both the web UI and the API, so large organizations can cover more of their codebase in a single scan instead of splitting the work into batches.

Auto-scan controls and schedules

Auto-scan can now be turned on or off directly from a session's Findings tab, rather than only from scan configuration. A scan's auto-scan schedule is also visible in the scan detail view and through the Devin MCP get_scan tool, so people and agents can check when the next run will happen without digging through settings.

Scheduled follow-ups after a threat model

When the threat-model lead finishes its work, Devin now offers to set up weekly or monthly incremental scans. This turns a one-off security review into an ongoing check, with later scans focused on what has changed since the previous run.

Related Findings improvements

The same release added small refinements around scan results. The Findings tab's quick-wins card shows a carousel of summaries for recommended findings. The organization-wide Findings page now opens as a session tab with a "Chat with Findings" entry point, making it easier to ask Devin questions about the results of a scan.

Why it matters

Recurring, scheduled scanning is what keeps findings from going stale. With higher repository limits, visible schedules and a one-step offer to automate follow-up scans, Windsurf's Devin makes continuous code scanning easier to adopt and easier to audit.