I Paid $500 For Devin And Found Critical Security Issues

A $500-a-month Devin setup for building a Twitch-integrated Pong game quickly turns into a security and process fiasco: the agent’s code-pushing workflow stalls for hours, then a later check reveals a potentially serious access-control weakness—anyone who can reach the Devin workspace URL can gain broad access to repositories. The result is a cautionary tale about treating AI coding agents like reliable teammates without hardening authentication, permissions, and operational guardrails.

The plan starts simple: use Twitch chat as the input stream for a Pong match, assign viewers to Team 1 or Team 2 (randomly to avoid storage complexity), and have “up”/“down” commands drive paddle movement. The envisioned architecture is a client-server system with a WebSocket channel: chat events produce keystroke signals, the server aggregates them over short intervals (e.g., 200 milliseconds) and updates game state, then broadcasts positional updates (paddles and ball) to connected clients. The game should be mostly server-rendered, with the client receiving compact state updates—potentially as small byte payloads—while still keeping timing consistent across players.

Devin is then tasked with bootstrapping the repository, choosing a stack (JavaScript/TypeScript tooling appears early), and implementing a Go WebSocket server (using gorilla/websocket) with Docker support and a defined port. Early progress looks promising: environment setup, a basic WebSocket server, and a local test page that successfully connects to the server. But the workflow becomes chaotic around Git operations. Devin repeatedly struggles with pushing changes to the correct branch, gets stuck on “push to master” requirements, and triggers long delays and session resets. The transcript shows repeated attempts to commit, push, create PRs, switch branches, and recover from repository/workspace confusion—at one point the user claims the agent “failed” and work must be restarted.

The most consequential moment comes after the Pong server is running and the user inspects access behavior. The user realizes that the Devin workspace URL (or related subdomains) is effectively reachable in a way that could allow others to access Devin’s capabilities. The user notes that subdomains can be exposed via certificate transparency and that, if the URL is leaked or guessed, remote parties may gain “full access” to repositories the agent can reach. The user frames this as a basic security principle violation: remote access should not grant carte blanche to sensitive code assets.

By the end, the user stops streaming, apologizes for accidentally exposing access, and emphasizes that the incident wasn’t the goal. The core takeaway is twofold: AI agents can accelerate implementation of a WebSocket server quickly, but without strict permission boundaries and reliable DevOps hygiene (branching, authentication, and workspace isolation), the same automation can create both operational delays and real security risk.