SCYLLA

what they built

Scylla is an autonomous SOC that blocks web attacks in milliseconds, reasons about the root causes, and has Devin patch that vulnerable code, then replays the attack to prove that the fix works. How it works: A data plane sits in front of the site, as a reverse proxy or as middleware for Express, Python (Flask/Django, FastAPI) or Cloudflare Workers. It checks every request in milliseconds and blocks, slows down or traps attackers in a honeypot. If the control plane goes down, it keeps enforcing the last rules it received. Every request event streams to the control plane, which groups requests from many IPs into one attack campaign. A reflex layer contains an attacker instantly. An LLM strategist, with a scripted fallback playbook, then reasons about the whole campaign. The strategist writes WAF rules that cover a whole family of attack payloads, blocks or slows IPs, deploys honeypots and tightens rate limits. When an attack points to a real bug in the code, Scylla opens a Devin session with the cleaned-up attack trace. Devin fixes the root cause, adds a regression test and opens a PR. During our own test, Devin opened PR #7 (Devin Review) for a SQL injection in our demo shop, with no human involved. After the fix merges, Scylla replays the original attack against the patched site and marks the incident verified or still exploitable. The War Room dashboard shows it all live: threat map, traffic and verdicts, the agent's reasoning, incidents and Devin's progress. From the dashboard you can launch 7 red-team attack types or a full assault, switch a site to shadow mode (log what would be blocked without blocking it), and add new sites. How we built it with Devin: The whole repo was built by two Devin sessions working in parallel that talked only through GitHub. Each owned its own folders under a shared typed contract. They logged every PR in COORDINATION.md, sent requests through coordination issues, and reviewed each other's PRs. One Devin built the control plane, agent, proxy, demo shop, red team, benchmark and self-healing check. The other built the War Room and the Python and Cloudflare Worker data planes. Tech Stack: TypeScript, Node, Express, WebSockets, React, Vite, Tailwind, SQLite demo origin, Python (ASGI/WSGI), Cloudflare Workers, Vitest/pytest, GitHub Actions.