By clicking “Accept All Cookies”, you agree to the storing of cookies on your device to enhance site navigation, analyze site usage, and assist in our marketing efforts. View our Privacy Policy for more information.
ToolAccuracy of FindingsDetects Non-Pattern-Based Issues?Coverage of SAST FindingsSpeed of ScanningUsability & Dev Experience
DryRun SecurityVery high – caught multiple critical issues missed by othersYes – context-based analysis, logic flaws & SSRFBroad coverage of standard vulns, logic flaws, and extendableNear real-time PR feedback
Snyk CodeHigh on well-known patterns (SQLi, XSS), but misses other categoriesLimited – AI-based, focuses on recognized vulnerabilitiesGood coverage of standard vulns; may miss SSRF or advanced auth logic issuesFast, often near PR speedDecent GitHub integration, but rules are a black box
GitHub Advanced Security (CodeQL)Very high precision for known queries, low false positivesPartial – strong dataflow for known issues, needs custom queriesGood for SQLi and XSS but logic flaws require advanced CodeQL experience.Moderate to slow (GitHub Action based)Requires CodeQL expertise for custom logic
SemgrepMedium, but there is a good community for adding rulesPrimarily pattern-based with limited dataflowDecent coverage with the right rules, can still miss advanced logic or SSRFFast scansHas custom rules, but dev teams must maintain them
SonarQubeLow – misses serious issues in our testingLimited – mostly pattern-based, code quality orientedBasic coverage for standard vulns, many hotspots require manual reviewModerate, usually in CIDashboard-based approach, can pass “quality gate” despite real vulns
Vulnerability ClassSnyk (partial)GitHub (CodeQL) (partial)SemgrepSonarQubeDryRun Security
SQL Injection
*
Cross-Site Scripting (XSS)
SSRF
Auth Flaw / IDOR
User Enumeration
Hardcoded Token
ToolAccuracy of FindingsDetects Non-Pattern-Based Issues?Coverage of C# VulnerabilitiesScan SpeedDeveloper Experience
DryRun Security
Very high – caught all critical flaws missed by others
Yes – context-based analysis finds logic errors, auth flaws, etc.
Broad coverage of OWASP Top 10 vulns plus business logic issuesNear real-time (PR comment within seconds)Clear single PR comment with detailed insights; no config or custom scripts needed
Snyk CodeHigh on known patterns (SQLi, XSS), but misses logic/flow bugsLimited – focuses on recognizable vulnerability patterns
Good for standard vulns; may miss SSRF or auth logic issues 
Fast (integrates into PR checks)Decent GitHub integration, but rules are a black box (no easy customization)
GitHub Advanced Security (CodeQL)Low - missed everything except SQL InjectionMostly pattern-basedLow – only discovered SQL InjectionSlowest of all but finished in 1 minuteConcise annotation with a suggested fix and optional auto-remedation
SemgrepMedium – finds common issues with community rules, some missesPrimarily pattern-based, limited data flow analysis
Decent coverage with the right rules; misses advanced logic flaws 
Very fast (runs as lightweight CI)Custom rules possible, but require maintenance and security expertise
SonarQube
Low – missed serious issues in our testing
Mostly pattern-based (code quality focus)Basic coverage for known vulns; many issues flagged as “hotspots” require manual review Moderate (runs in CI/CD pipeline)Results in dashboard; risk of false sense of security if quality gate passes despite vulnerabilities
Vulnerability ClassSnyk CodeGitHub Advanced Security (CodeQL)SemgrepSonarQubeDryRun Security
SQL Injection (SQLi)
Cross-Site Scripting (XSS)
Server-Side Request Forgery (SSRF)
Auth Logic/IDOR
User Enumeration
Hardcoded Credentials
VulnerabilityDryRun SecuritySemgrepGitHub CodeQLSonarQubeSnyk Code
1. Remote Code Execution via Unsafe Deserialization
2. Code Injection via eval() Usage
3. SQL Injection in a Raw Database Query
4. Weak Encryption (AES ECB Mode)
5. Broken Access Control / Logic Flaw in Authentication
Total Found5/53/51/51/50/5
VulnerabilityDryRun SecuritySnykCodeQLSonarQubeSemgrep
Server-Side Request Forgery (SSRF)
(Hotspot)
Cross-Site Scripting (XSS)
SQL Injection (SQLi)
IDOR / Broken Access Control
Invalid Token Validation Logic
Broken Email Verification Logic
DimensionWhy It Matters
Surface
Entry points & data sources highlight tainted flows early.
Language
Code idioms reveal hidden sinks and framework quirks.
Intent
What is the purpose of the code being changed/added?
Design
Robustness and resilience of changing code.
Environment
Libraries, build flags, and infra metadata flag, infrastructure (IaC) all give clues around the risks in changing code.
KPIPattern-Based SASTDryRun CSA
Mean Time to Regex
3–8 hrs per noisy finding set
Not required
Mean Time to Context
N/A
< 1 min
False-Positive Rate
50–85 %< 5 %
Logic-Flaw Detection
< 5 %
90%+
Severity
CriticalHigh
Location
utils/authorization.py :L118
utils/authorization.py :L49 & L82 & L164
Issue
JWT Algorithm Confusion Attack:
jwt.decode() selects the algorithm from unverified JWT headers.
Insecure OIDC Endpoint Communication:
urllib.request.urlopen called without explicit TLS/CA handling.
Impact
Complete auth bypass (switch RS256→HS256, forge tokens with public key as HMAC secret).
Susceptible to MITM if default SSL behavior is weakened or cert store compromised.
Remediation
Replace the dynamic algorithm selection with a fixed, expected algorithm list. Change line 118 from algorithms=[unverified_header.get('alg', 'RS256')] to algorithms=['RS256'] to only accept RS256 tokens. Add algorithm validation before token verification to ensure the header algorithm matches expected values.
Create a secure SSL context using ssl.create_default_context() with proper certificate verification. Configure explicit timeout values for all HTTP requests to prevent hanging connections. Add explicit SSL/TLS configuration by creating an HTTPSHandler with the secure SSL context. Implement proper error handling specifically for SSL certificate validation failures.
Key Insight
This vulnerability arises from trusting an unverified portion of the JWT to determine the verification method itself
This vulnerability stems from a lack of explicit secure communication practices, leaving the application reliant on potentially weak default behaviors.
DryRun Security News
June 23, 2026

Bringing Next-Generation AppSec to GitHub Enterprise Server

One of the realities of enterprise security is that the organizations carrying the greatest security burden are often the last to benefit from the latest security innovation.

They operate some of the world's most important software systems. They manage enormous codebases, large engineering organizations, complex compliance requirements, and increasingly sophisticated threats.

Yet when a new generation of security technology emerges, enterprise teams are frequently told they'll need to wait. Support for their environment comes later… if it comes at all. 

At DryRun, we don't believe that should be the case.

That's why I'm excited to announce that DryRun Security now supports GitHub Enterprise Server (GHES), bringing DryRun’s AI powered application security capabilities directly into enterprise GitHub environments

The Teams With the Highest Stakes Need the Best Tools

Over the last several years, we've seen tremendous advances in what application security can accomplish.

AI has fundamentally changed our ability to understand software risk. Instead of relying solely on signatures, patterns, and predefined rules, modern systems can reason about code, understand intent, identify security-relevant behavior, and help teams focus on the changes that matter most.

And if there's any group that should benefit from these advances, it's enterprise security teams.

These organizations aren't protecting simple applications. They're protecting critical business systems, customer data, financial platforms, healthcare applications, government infrastructure, and the software that powers much of the modern world.

The stakes are higher and the environments are more complex. .So, we feel they deserve access to the best security technology available.

Meeting Customers Where They Are

Over the past year, we've had conversations with security leaders, AppSec teams, and engineering organizations that were excited about DryRun's approach to application security.

The conversation often ended with the same question:

"Do you support GitHub Enterprise Server? (GHES)"

For many organizations, that's not a preference. It's a requirement.

GitHub Enterprise Server exists because organizations have legitimate needs around governance, compliance, data residency, network isolation, and operational control. These are often the same organizations with the most mature security programs and the greatest need for advanced security capabilities.

We heard that feedback clearly and this is why supporting GitHub Enterprise Server became a major focus for our team because we believe organizations shouldn't have to choose between the development environment that meets their business requirements and the security technology that helps protect it.

Bringing DryRun to GHES

With GitHub Enterprise Server support, organizations can now bring DryRun's AI-powered application security capabilities directly into their existing development ecosystem.

Security teams can leverage DryRun to better understand software risk, identify security-relevant changes, investigate emerging threats, and help developers make informed security decisions - all within the GitHub Enterprise Server environments they already rely on.

Looking Ahead

Our announcement of support for GitHub Enterprise Server is more than a platform milestone for us.It's a reflection of something we believe deeply:The organizations responsible for protecting the most important software shouldn't have to wait for innovation to reach them.

We're committed to continuing that investment and ensuring that enterprise teams can take advantage of the latest advances in application security, regardless of where their code lives.

We’re excited to see what our customers build with it.

Running GitHub Enterprise Server? Bring DryRun’s AI-powered application security capabilities directly into your existing development workflow. Get Started!