Windsurf: Devin Security Connections Now Ingest Findings From SonarQube, Linear and Vanta

WindsurfOct 30, 2026View original changelog

Windsurf's Devin can now pull security findings from SonarQube, Linear and Vanta through new Security connections. The Linear connection supports two-way state and priority sync, and issues Devin creates in Linear link back to the finding. Dismissing, reopening or resolving a GitHub Advanced Security finding in Devin now also updates the alert in GitHub.

Key Takeaways

Three new Security connections let Windsurf's Devin ingest findings from SonarQube, Linear and Vanta.
The Linear connection syncs state and priority in both directions, so ticket status and finding status stay aligned.
Issues that Devin creates in Linear link back to the originating finding, keeping security context one click away.
Dismissing, reopening or resolving a GitHub Advanced Security finding in Devin now updates the alert in GitHub.
Imported findings can be assigned to Devin for remediation, just like findings from its own scans.
The release turns the Findings page into a central triage inbox across static analysis, compliance and ticketing tools.

Three new sources for security findings

Windsurf's Devin gained three new Security connections on October 30, 2026. Teams can now bring findings from SonarQube, a Linear team and Vanta into Devin's Security area, alongside the findings Devin produces from its own code scans. The result is a single place to triage, assign and remediate issues that previously lived in separate tools.

SonarQube and Vanta imports

The SonarQube and Vanta connections ingest findings so that they appear in Devin's organization-wide Findings view. From there, a finding can be assigned to Devin for remediation, the same way a finding from a Devin scan would be. This means static analysis results and compliance-flagged issues no longer need a separate manual hand-off before work on a fix can begin.

Linear with two-way sync

The Linear connection goes further than a one-way import. Windsurf's Devin ingests findings from a chosen Linear team and keeps state and priority in sync in both directions. When Devin creates an issue in Linear for a finding, that issue links back to the finding, so engineers can move between the ticket and the security context without searching for it.

GitHub Advanced Security stays in step

The same release also tightened the existing GitHub Advanced Security connection. Dismissing, reopening or resolving a GitHub Advanced Security finding inside Devin now updates the matching alert in GitHub. Previously the two views could drift apart, leaving teams to close alerts in two places.

Why it matters

Security work tends to be scattered across scanners, ticket trackers and compliance platforms. By accepting findings from these tools and writing status changes back, Windsurf's Devin positions its Findings page as a working inbox for vulnerability remediation, with automated fixes available on any imported item.