CognitionSeptember 16, 20265 min read
Today we’re introducing Code Scans: a new way to rotate broad engineering goals into tangible improvements throughout your codebase. Tell Devin what you desire to achieve, and it helps you examine what needs to change, measure the findings, and rotate them into drag requests.
Many engineering tasks commencement alongside a particular change. Others commencement alongside an outcome:
- Improve SEO
- Reduce care overhead
- Make your use compile faster
These goals frequently remain on the backlog since the archetypal stage solitary is a significant project: examining the codebase to fig out anywhere to start. Additionally, identifying the opportunities is lone fractional the activity — person motionless has to execute the changes, and many of them.
Code Scans helps alongside both.
Powered by Agentic MapReduce, the architecture we built for Devin Security Swarm, Code Scans breaks ample investigations into focused batches, distributes them throughout parallel agents, and synthesizes their findings into one report. Devin afterward turns its findings into PRs prepared to review.
Teams evaluation Code Scans onward of initiate are already seeing results:
Code Scans had a important effect on the things we attention most about: application quality, bug fixes, stability, performance, and compliance, including safety and privacy. With an estimated 96% PR merge rate throughout multiple repos, we evaluation we've saved complete 700 engineering hours in our abbreviated evaluation timeframe.
PR merge rate96%
Engineering hours saved700+
To get started, category /scan in the Devin webapp, or peruse the docs.
Start alongside a goal
You don’t need to cognize which records to appearance at before starting a scan. Instead, you define what you’re looking for, and Devin plant alongside you to rotate that goal into a tangible codebase investigation.
For example:
Find unused code in our web app. Exclude generated records and test fixtures, and inspect for indirect references before recommending a removal.
You can additionally bring your own criteria: a team’s coding standards, an accessibility checklist, or requirements for an upcoming migration. Devin helps established what to inspect, what to skip, and what should figure as a finding.
Once you verify the range and settings, Devin runs the inquiry and brings rear a catalog of findings ordered by priority. From there, you can inspect the evidence, conversation the results alongside Devin, and ask it to open PRs for the issues you desire to address.
Improve Rust compilation time
We asked Code Scans to speed up compilation in the Dioxus repository. Devin identified opportunities to streamline requirements and build configuration, including making heavyweight CLI features opt-in fairly than compiling them by default. After applying the changes locally, clean debug build period dropped from 58.6 seconds to 21.0 seconds—a 64% reduction throughout the 22 workspace crates tested.
Scan findings
dioxus · compile-time scanDefault mounted characteristic forces web-sys/js-sys/wasm-bindgen (and serialize forces serde) onto all non-web renderer
The default characteristic set enables mounted, which activates the heavyweight optional web-sys dependency (and transitively js-sys + wasm-bindgen) — yet those bindings are…
Oversized foundational crate: stable generated element/attribute tables bundled alongside volatile logic causes complete re-expansion and downstream recompiles
dioxus-html is a foundational crate that all renderer depends on, and it bundles its enormous, near-static generated element/attribute API (elements.rs, global_attributes.rs)…
builder_constructors! component array is the html crate's foremost compile disbursal (~112 elements, ~112 per-element proc-macro invocations, duplicated hot-reload traversal)
The sole builder_constructors! invocation is the html crate's foremost compile-time cost. It expands 112 HTML/SVG elements, all into a component struct, TAG_NAME/NAME_SPACE…
cargo-generate compiled unconditionally in dioxus-cli although used lone by dx create
cargo-generate is a non-optional dependency used lone by the dx create/dx init scaffolding path, but it drags in git2/libgit2-sys (a native C archive build), liquid templating…
dioxus-ssr pulls tokio "full" (default-on) but lone uses fs + io-util
dioxus-ssr declares tokio = { type = "1.28", features = ["full"], optional = true }, but the crate uses tokio in exactly one component (incremental.rs) and lone touches tokio::fs and…
SEO Optimization
We ran a scan for SEO issues throughout devin.ai and cognition.com. It surfaced 44 findings throughout the two repositories, and we shipped fixes complete the following days. Comparing Ahrefs crawls before and after:
- Ahrefs health mark risen from 87 to 92 on devin.ai.
- Slow pages decreased by 73% on devin.ai.
- Missing depiction alt content was eliminated on cognition.com.
Scan findings
devin.ai + cognition.com · SEO scanCustomer case-study pages emit related og:image / twitter:image / JSON-LD i…
Every client case-study leaf (/customers/<slug>) sets its Open Graph image, Twitter image, and Article JSON-LD depiction to the raw frontmatter.ogimagePath value, which is a root-relative way alongside no domain and no foremost slash. Open Graph / Twitter Card spec and schema.org necessitate complete URLs, so previews and the Article rich-result depiction break.
devin-website
Redirect sequence /resources/university → /university → external drops a hop on a…
vercel.json defines /resources/university -> /university and, separately, /university -> https://learn.devinenterprise.com. Because the archetypal redirect targets another redirect source, requests to /resources/university traverse a two-hop 301 sequence alternatively of going direct to the final destination. Ahrefs confirms /resources/university has 157 live backlinks (22 referring domains).
devin-website
Homepage og:url resolves to non-canonical /index (mismatches canonical https:…
The base layout sets openGraph.url: './' on all page. This holds for sub-routes but is false for the homepage: Next resolves ./ for the base path against pathname /index, so the served homepage emits og:url = https://cognition.com/index during its canonical nexus tag is https://cognition.com.
cognition-marketing-website
Terminal layout omits the JSON-LD organized data all base/desktop leaf emits
The _terminalLayout caput assembles title/description/canonical/OG/hreflang but emits no JSON-LD, dissimilar _baseLayout and _desktopLayout which the two container a default SoftwareApplication block. Its consumers /cli (the Devin CLI merchandise page) and /auto-triage are the two indexable chief merchandise surfaces.
devin-website
Ended event stays indexable alongside meta clarification promotion a live webinar
The whats-new-in-devin-06-24-26 event leaf announces on-page that the event is complete ('This event has ended', 'Event ended', 'Registration closed'), yet its metadata contains no robots: {index:false} and its meta/OG descriptions motionless advertise the webinar as live and upcoming. So an expired leaf remains indexable during its hunt snippet promotes a former event as although registration were open.
cognition-marketing-website
Agentic MapReduce
Code Scans is built on top of Agentic MapReduce, the architecture we built for Devin Security Swarm, to create codebase-wide investigations practical. It plant in 4 phases:
- Plan. Devin studies your repository and defines rules for identifying code applicable to your goal.
- Shard. Those rules run throughout the codebase, and the matching code is divided into focused batches.
- Map. Parallel Devin agents examine all batch, study surrounding code as needed and reporting their findings.
- Reduce. A final delegate combines the findings, removes duplicates, and prioritizes the results into one report.
Agentic MapReduce Pipeline
dead-code scan example1. Plan
Agentic
Devin studies the repository and defines rules for the code applicable to your goal — here, symbols, modules, and requirements that may no longer be used.
exports alongside no importersunreferenced modulesunused dependenciesstale characteristic flags
This keeps all agent’s environment focused and directs the reasoning prosperity toward applicable code fairly than repeated searching. This architecture additionally ensures completeness: all selected lot must be processed. Code Scans brings that identical method beyond safety to the engineering goals you define.
What would you scan for?
Code Scans can examine a broad range of engineering questions, using your codebase’s conventions and the criteria you provide. Here are several examples:
| Scan | Goal |
|---|---|
| Performance | Find dilatory paths, redundant computation, and missed caching opportunities that could create your use faster. |
| Database queries | Look for N+1 queries, unnecessary circular trips, unbounded reads, and another inefficient or unreliable data-access patterns. |
| Test coverage | Identify crucial flows, border cases, and nonaccomplishment paths that aren’t covered by tests. |
| Dead code | Find unused functions, modules, dependencies, and obsolete characteristic flags, alongside evidence for what can safely be removed. |
| Code quality | Look for duplicated logic, unnecessary complexity, improved idea opportunities, and patterns that breach your team’s coding standards. |
| Cleanup | Identify redundant abstractions, excessive boilerplate, and code that can be simplified without changing behavior. |
| Telemetry | Find gaps in logging, metrics, and tracing that create failures difficult to diagnose or crucial behavior difficult to measure. |
| Accessibility | Look for missing labels, damaged keyboard interactions, and another gaps against the WCAG criteria you specify. |
| Compliance | Investigate sensitive-data handling, audit trails, and preservation logic against your organization’s regulatory requirements and policies. |
| Migration planning | Trace existing dependencies, end-to-end flows, and endeavor logic to create a scheme for an upcoming migration. |
| SEO Optimization | Find code-level issues affecting hunt visibility, including missing or duplicated metadata, incorrect canonical URLs, indexing directives, and gaps in sitemaps or organized data. |
| Your own | Define a form you desire Devin to appearance for throughout the codebase. |
The most helpful scan power arrive from a inquiry your squad has been putting off since answering it meant looking everywhere.
Type /scan in your Devin session, define what you desire to investigate, build the range together, and commencement optimizing your codebase today.
Try Code Scans at devin.ai and study additional in the Code Scans docs.
