DryRun Security

What do you like best about the product?

DryRun finds bugs that pattern-matching scanners don’t. The findings I care most about came from its DeepScans and PR reviews: authorization logic that skips a check, an SSRF that only works through DNS rebinding, a CI role that hands far more IAM access than it should to anyone who can push a branch. No regex catches those. You have to read the code and follow how it actually runs, and that’s what DryRun does.

The PR comments show up where our engineers already work, so a problem gets raised while the author still remembers the change. The API is solid enough that I built my own triage tooling on top of it, pulling findings and posting verdicts back. The team is easy to work with too: we meet monthly, they walk us through release notes, and they’ve taken our API requests back to their engineers.

What do you dislike about the product?

Closing the loop on fixed findings still takes some manual work. When a fix merges, the finding doesn’t always clear on its own, so we end up marking a few as Resolved by hand. The DryRun team knows about it and is working on it, and they’ve been responsive every time we’ve raised it.

What problems is the product solving and how is that benefiting you?

We’re a small team shipping a lot of code, and we don’t have a dedicated AppSec engineer reading every PR. DryRun fills that gap. It reviews each pull request as it’s opened, and its DeepScans go through the whole codebase looking for the kind of logic and authorization bugs that rule-based scanners don’t catch.

The benefit for us is that security review happens without slowing anyone down. Engineers get feedback on the PR while the change is still fresh, and I get one risk register across our repos for code, dependency and infrastructure findings. Since October we’ve taken that register from 167 open findings down to 8, and the ones left are issues we’ve checked ourselves and are working through. When someone asks where our code stands, I can answer from that list.

What do you like best about the product?

We finally have visibility into the vulnerabilities that exist in the projects we’re developing, whereas before we were essentially flying blind. The user interface is easy to navigate, and it supports tie-ins with the AI models we’re using today.

What do you dislike about the product?

The pricing for using the DeepScan can be expensive.

What problems is the product solving and how is that benefiting you?

It helps uncover and resolve open vulnerabilities introduced by AI models during code development.

What do you like best about the product?

DryRun was very easy to use, and was immediately helpful. I ran a deep scan and used the finding details to fix each vulnerability very quickly.

What do you dislike about the product?

It would be cool if the PR scans could update the risk register as vulnerabilities got patched.

What problems is the product solving and how is that benefiting you?

I can keep up with the LLMs developing on my project, and be sure that they didnt leave the back door open.

What do you like best about the product?

DryRun Security helps solve the problem of noisy and time-consuming security reviews by providing contextual, high-signal findings directly in the developer workflow. Instead of spending unnecessary time sorting through false positives or trying to determine which issues are actually exploitable, the platform uses AI-driven analysis to help identify the risks that actually matter and explain them in a way developers can act on. Its performance has also been a benefit, as it fits well into the pull request process without creating unnecessary friction or slowing down development.

It also helps bridge the gap between security and development teams. By providing AI-powered remediation guidance, pull request context, and policy-based guardrails, DryRun Security makes it easier to maintain security standards while still allowing teams to move quickly. The support experience has been another positive, with helpful guidance when questions come up or when we need assistance getting more value from the platform. Overall, DryRun Security supports faster, more confident development while giving security teams better visibility into code risk across repositories.

What do you dislike about the product?

The main thing I would like to see improved is broader integration with external workflow and ticket management platforms, especially Jira. While DryRun Security provides useful findings and guidance in the developer workflow, having a more seamless way to create, track, and manage security tickets in Jira would make it easier for teams that rely heavily on Jira for vulnerability management, sprint planning, and remediation tracking. Stronger integrations with external platforms would help security and engineering teams operationalize findings more effectively across their existing processes.

What problems is the product solving and how is that benefiting you?

DryRun Security helps solve the problem of noisy and time-consuming security reviews by providing contextual, high-signal findings directly in the developer workflow. Instead of spending unnecessary time sorting through false positives or trying to determine which issues are actually exploitable, the platform uses AI-driven analysis to help identify the risks that actually matter and explain them in a way developers can act on. Its performance has also been a benefit, as it fits well into the pull request process without creating unnecessary friction or slowing down development.

It also helps bridge the gap between security and development teams. By providing AI-powered remediation guidance, pull request context, and policy-based guardrails, DryRun Security makes it easier to maintain security standards while still allowing teams to move quickly. The support experience has been another positive, with helpful guidance when questions come up or when we need assistance getting more value from the platform. Overall, DryRun Security supports faster, more confident development while giving security teams better visibility into code risk across repositories.

What do you like best about the product?

Since its agentic and doesn't depend on rules, theres good coverage across any language, framework, or tool out of the box. It's been particularly helpful providing feedback to engineers on changes to infra level concerns like terraform or helm.

What do you dislike about the product?

No major downsides, just needs some refinement as it grows. Slack alerts can be a bit noisy, for example. Thus far the team has sought feedback frequently and eventually comes up with solutions.

What problems is the product solving and how is that benefiting you?

Scaling rich, contextual security feedback for engineers without slowing down our velocity. Critical issues are rare to start with in our environment, but it has flagged a few at the PR stage before they get merged, which is also great.