Frequently Asked Questions

AI code review uses AI to examine code changes and explain issues before they ship. For security teams, the useful question is how a change could be abused in the application. DryRun Security performs automated adversarial review using application context and your security policies, with findings delivered in your pull request workflow.

The DryRun Security Platform fits teams that need security review to keep pace with AI-assisted development. AppSec sets the requirements for what can merge, while developers and coding agents get the context to address findings. See how PR code reviews work in GitHub and GitLab.

AI SAST applies AI reasoning to static application security testing, examining source code for vulnerabilities without requiring a running application. Traditional SAST uses techniques such as rules and dataflow analysis to detect known classes of defects. AI adds a way to investigate security questions whose answers depend on what the application is trying to do.

DryRun Security's AI-native SAST uses Contextual Security Analysis to examine code in its application context. An authorization decision, for example, depends on who should be allowed to reach an object and which controls enforce that boundary. Evaluate an AI SAST tool on whether it can explain that failure path in your codebase.

Hybrid SAST combines deterministic static analysis with AI reasoning about application behavior. Rules and dataflow analysis establish useful facts; contextual analysis investigates what those facts mean for a particular application. An authenticated request can still expose another tenant's data if the ownership check is missing.

DryRun Security fits this approach through independent code review and its Veracode integration. Keep the controls your program already relies on, then measure the additional vulnerabilities found and the quality of the resulting repairs. The Veracode partnership is a concrete example of combining established static analysis with contextual AI analysis.

SAST examines code without running the application. DAST tests a running application from the outside. SCA identifies third-party components and their known vulnerabilities. Each answers a different security question, and a useful program chooses coverage around its actual exposure.

DryRun adds contextual code analysis to PR reviews and full-repository investigations, with dependency analysis also available through DeepScan. It examines behavior such as a valid request crossing a tenant boundary. A hybrid SAST approach combines that reasoning with existing static analysis, while runtime testing continues to examine the deployed application.

An independent security reviewer gives your team a separate control for evaluating code before it merges. A coding assistant is working toward an implementation goal; security review must examine how that implementation behaves when someone tries to abuse it. A passing functional test does not establish that a user cannot cross an authorization boundary.

DryRun Security provides that review through your source control workflow. Its findings give AppSec evidence for merge decisions and give the coding agent context for a repair. We call this ongoing practice Adversarial Code Assurance. The AISSMM field guide explains how independent evaluation fits into an AI software security program.

Compare AI code security tools on the vulnerabilities they find in your application and the workflow your team can operate. Our code security capability matrix covers DryRun Security, Semgrep, Snyk Code, Aikido, and other platforms. Use it to identify the capabilities that matter for your repositories, then test them with the same code and security requirements.

The 2025 SAST benchmark results provide measured detection counts for five tools, while the 2026 Security Scanner Bakeoff evaluates DryRun, Semgrep, and Aikido on a separate 40-vulnerability test. A useful comparison includes missed vulnerabilities and the quality of repair guidance, alongside false positives. Our proof-of-concept checklist explains how to evaluate those outcomes.

Use representative repositories with known security defects and a sample of normal changes. Include an authorization flaw that crosses files, an application-specific policy violation, and a repair that should close a finding. Give each candidate the same repository access and record its configuration before comparing results.

Count confirmed findings and missed vulnerabilities separately from false positives. Then have a developer use the evidence to fix an issue and run the review again. This tests whether the product helps your team reach a sound merge decision. Our capability matrix helps define the comparison; a DryRun evaluation lets you examine the workflow on your own code.

Build an AI security scanner when your organization intends to own and maintain the verification system as a product. Connecting an LLM to a repository is an initial step. A dependable system also needs application context and evaluation that detects regressions when either the codebase or the model changes. Someone must own the integrations and the quality of findings developers receive.

Buying DryRun Security gives your team an independent review platform with PR analysis, deeper repository investigation, and custom policy enforcement. AppSec can focus on security requirements and risk decisions while developers keep their preferred coding tools. Our AI Code Security Build vs. Buy guide lays out the platform investment. Book a demo to evaluate the workflow on your code.

Start where code enters the application: source control. Give AI-generated changes an independent security review, establish a baseline for the existing repository, and decide which findings should block a merge. Developers need enough context to repair a finding, followed by a review of the changed code.

The AI Software Security Maturity Model (AISSMM) gives security leaders a framework for developing that practice. The DryRun Security Platform supplies automated adversarial review and retains application knowledge through the security context graph. Your AppSec team owns the policies and risk decisions, with evidence that carries forward as the application changes.

DryRun Security detected 23 of 26 seeded vulnerabilities, approximately 88%, in our 2025 SAST Accuracy Report. We tested five tools on public, intentionally vulnerable applications in Ruby on Rails, Python/Django, C#/ASP.NET Core, and Java/Spring Boot, using their out-of-the-box configurations without custom rules or tuning.

Tool tested	Seeded vulnerabilities detected
DryRun Security	23 of 26
Semgrep	12 of 26
Snyk Code	10 of 26
GitHub Advanced Security (CodeQL)	8 of 26
SonarQube / SonarCloud	2 of 26

The test included classic injection vulnerabilities and logic flaws such as broken object-level authorization. DryRun found nearly twice as many seeded issues as the nearest tool in that test. The full report publishes the methodology and individual results so your team can examine the evidence and reproduce the comparison.

In our 2025 out-of-the-box comparison, DryRun Security found 23 of 26 seeded vulnerabilities and Semgrep found 12 of 26 across four language tests. In the C# test, Semgrep detected three classic vulnerabilities but missed the seeded IDOR and broken-authentication cases. Those failures depended on understanding the application's access controls. The 2025 report also records a Semgrep SQL injection rule improvement reported after testing.

Our separate 2026 Security Scanner Bakeoff compares DryRun Security, Semgrep, and Aikido across 40 intentional, reachable vulnerabilities in Ruby, Java, Python, and C#. Use the report for that test's results and configurations. The 26-vulnerability scores above belong to the 2025 study. Read each report alongside its test configuration when comparing coverage on your stack.

In the Agentic Coding Security Report, 87% of pull requests introduced at least one security vulnerability. DryRun Security identified 143 security issues across 38 scans after asking Claude, Codex, and Gemini to build two applications through sequential pull requests. None of the agents produced a fully secure application in that study.

The experiment followed feature development through successive changes, which is how teams actually ship software. Its results show why a working feature still needs security review: functional progress can coexist with exploitable behavior. DryRun reviews each change independently and supplies the context needed to repair a finding before it ships.

Our July 2026 analysis of customer code findings classified 202,700 security findings, including 24,514 AI-specific findings. Prompt injection accounted for 12,194 of the AI findings, and excessive privileges accounted for 10,200. Together, those categories represented about 91% of the AI-specific findings in that dataset.

The finding counts point to concrete review priorities: follow untrusted input into model instructions, and examine what an agent's credentials and tools allow it to do. DryRun's AI application coverage also includes LLM tool misuse and related application-level risks.

Dependency Exploit Validation examines dependency findings in application context so AppSec can focus its review on the risks that matter. Customers are seeing a ~92% reduction in dependency findings to review. In one customer's experience, 4,000 dependency findings became 397 actionable, high-priority findings. That individual example is about a 90% reduction; it is separate from the broader customer-results figure.

The outcome is a smaller, prioritized review queue. Your team can spend its time investigating exposure and choosing repairs instead of treating every package match as equally urgent. See the customer example and Dependency Exploit Validation overview, alongside the SCA documentation for dependency discovery and CVE matching.

Veracode named DryRun Security the inaugural partner in the Veracode Marketplace in its July 30, 2026 announcement. The partnership combines Veracode's deterministic scanning and security intelligence with DryRun's contextual AI analysis, giving enterprises a way to add AI code verification through their existing Veracode relationship.

Veracode's September 16 integration release notes explain the implementation: Veracode Static Analysis findings feed DryRun analysis and developer workflows, while Veracode remains the authoritative source for its own findings. DryRun adds application context and guidance for pull request review and AI-assisted remediation. The Marketplace overview explains procurement and the combined offering.

Yes. DryRun Security reviews code submitted through connected GitHub or GitLab repositories, regardless of whether a developer or an AI coding tool wrote it. Your team can use Claude Code, Codex, GitHub Copilot, or Cursor while maintaining a consistent security review process at the pull request.

We separate code generation from code-security verification because the security requirement belongs to the application. Changing coding assistants should not change which risks your team accepts. Our Agentic Coding Security Report examines security risks in applications built with Claude, Codex, and Gemini.

Yes. DryRun Security analyzes business logic and authorization vulnerabilities, including insecure direct object references and missing access checks. These issues often involve valid code doing something a user should never be allowed to do. An endpoint might authenticate a customer correctly, then let that customer retrieve another tenant's invoice by changing an identifier.

Finding that flaw requires examining the relationship between the request and the application's authorization controls. DryRun uses application context to investigate those relationships in PR reviews and broader repository reviews with DeepScan. The vulnerability coverage documentation describes the finding categories and their CWE mappings.

Yes. DryRun Security's documented vulnerability coverage includes prompt injection and LLM tool misuse. Code review can investigate how untrusted input reaches a model and whether the surrounding application gives model-driven actions access to sensitive operations. The security boundary includes the code that handles tool calls and enforces permissions.

For an AI application, review what an attacker-controlled response could cause the application to do. DryRun's custom code policies let your team express application-specific requirements, such as requiring authorization before a tool accesses customer data. See the coverage matrix for the supported finding types.

DryRun Security analyzes code changes with the surrounding application context and your configured security policies. The review investigates how a change could be abused, then returns findings in the development workflow so a developer can understand the issue before merging.

Our COVER model explains the work: Context establishes the application, Orchestration directs the analysis, Verification examines candidate findings, Exploitability considers the attack path, and Reporting gives the team evidence for a decision. See the PR scanning documentation for the review workflow and the merge controls for enforcement.

DeepScan performs a full-repository security analysis. It examines the complete codebase and traces relationships across files, including security risks in older code that a review of the latest pull request would not cover. The result is a set of findings your team can prioritize and use for remediation.

You can select the repository and branch to investigate and apply repository context to the scan. This makes DeepScan useful both for an initial security baseline and for later investigations as the application evolves. Learn how repository scanning with DeepScan complements incremental PR checks.

Use DeepScan when you need a baseline of the repository's existing security risk. Good checkpoints include onboarding an application, investigating an incident, preparing for a release, or reviewing a major refactor. A flaw introduced before PR review was installed still deserves attention even if nobody changes that file today.

Keep PR review running for new changes and use full-repository reviews at the checkpoints that fit your release process. The DeepScan documentation explains repository and branch selection, configuration, and how findings appear during the analysis.

DryRun uses specialized analyzers for distinct security questions. An IDOR investigation examines whether an object access enforces the right authorization boundary. SQL injection, cross-site scripting, and server-side request forgery analyses follow different paths from untrusted input to a sensitive operation. Mass assignment and secrets scanning address additional risks.

The General Security Analyzer investigates broader application security concerns alongside those focused checks. Each analysis needs relevant evidence rather than one generic instruction to find every possible bug. The vulnerability coverage matrix lists supported finding categories and their CWE mappings.

The Code Review Agent examines incoming changes, while DeepScan investigates the existing repository. The Custom Policy Agent applies the requirements your team defines. Their findings and retained context give AppSec a consistent basis for reviewing risk across the application.

Security Intelligence makes that knowledge accessible for questions about code and findings, including through Insights MCP. Developers and coding agents can use the evidence to make repairs, and subsequent reviews check the changed code. The connection between these workflows is what makes the platform useful beyond an isolated scan.

DryRun Security PR and merge request reviews typically take about one minute, as shown in our platform overview. The review runs in the source control workflow so developers receive security feedback while the change is still in front of them.

DeepScan examines a broader scope and has a different turnaround. During a full-repository scan, findings begin appearing as they are validated. In an evaluation, compare the review time on your repositories with the time your team needs to understand and act on the results.

Yes. Findings explain the security problem and provide guidance a developer or AI coding agent can use to make a repair. Useful guidance connects the vulnerable behavior to the application, so the person making the change understands which security boundary the fix must restore.

DryRun's remediation workflow and agent integrations bring that context into development. The developer or agent changes the code, and a subsequent review evaluates the result. AppSec keeps control of the requirements for merging the repair.

DryRun Security supplies findings and application context that an AI coding agent can use to develop a repair. The Insights MCP integration lets supported assistants query PR findings and security data from the development environment. The DryRun Skill connects that information to the coding workflow.

The agent makes the code change, and subsequent security review evaluates the updated code. Your team retains control of merge requirements. This gives developers a path from a finding to a reviewed repair, with the reasoning available for AppSec to inspect.

Contextual Security Analysis is the approach behind DryRun Security's code review. It uses information about the application and the proposed change to investigate security behavior. Repository structure and data flow establish the scope; specialized analysis then examines questions such as whether a request can reach another user's data.

A model response becomes useful when the surrounding platform supplies relevant evidence and tests the conclusion against the code. DryRun carries application context and reviewed decisions into later analysis through the security context graph. Read the CSA guide and see how to add repository context that reflects your own controls.

SLIDE organizes the context needed to judge a security risk:

• Surface: the entry points and exposure an attacker can reach.
• Language: the language and framework conventions that shape behavior.
• Intent: what the change is meant to accomplish.
• Design: the architecture, data flow, and trust boundaries around the code.
• Environment: the surrounding infrastructure and consequences of an exploit.

An authorization check, for example, only makes sense when you understand the object being accessed and which user should control it. Contextual Security Analysis uses these signals to examine the risk in the application and explain why a finding deserves attention.

DryRun Security prioritizes findings by impact and likelihood in application context. A vulnerable operation that exposes customer data needs a different response from a similar-looking operation protected by the application's access controls. The explanation should let a developer and an AppSec reviewer understand why the issue matters.

The SLIDE model organizes the signals behind that assessment, including the attack surface and the design of the application. Your team can use finding severity to set merge-blocking thresholds, then record remediation or a reviewed risk decision.

DryRun combines application context with focused analysis of candidate vulnerabilities. Repository context can explain an authentication layer or a design convention that would otherwise be missing from the review. When a result is incorrect, finding feedback records why it does not apply.

That explanation matters more than a dismissal alone. DryRun uses finding tuning and repository context to carry reviewed knowledge into future scans. A false positive and an accepted risk remain different decisions: one corrects the analysis; the other records a real issue the team has chosen to accept.

Security memory carries application knowledge and reviewed decisions into later analysis, so each review can use what your team has already learned. In DryRun Security, repository context explains controls and design choices. Finding feedback records why a specific result is a false positive or why the team accepted a risk.

Useful explanations feed the security context graph and inform future scans. That distinction matters: an accepted risk remains a documented decision, while a false positive describes an incorrect finding. AppSec can revisit those decisions as the application changes. Our finding tuning documentation explains how feedback is recorded and applied.

The Custom Policy Agent evaluates code against security requirements written in natural language. You describe the condition to check and provide the background needed to interpret it, such as requiring a tenant ownership check before an endpoint returns customer data. The Policy Assistant helps turn existing documentation into policies your team can use.

This gives AppSec a way to apply application-specific knowledge in the review process. Configure the policy for the repositories it covers and decide whether a violation should block a merge. Start with the NLCP policy library and the custom code policy documentation.

Yes. Configure a minimum blocking severity and make DryRun Security a required check in your source control branch protection. For example, a High threshold fails the check for High and Critical findings. Your team can also configure particular analyzers or custom code policies to block whenever they produce a finding.

The connection to branch protection is what enforces the decision. A reported finding alone does not stop a merge. The PR blocking documentation explains the configuration so your team can choose and verify the controls that apply to each repository.

DryRun Security supports all programming languages and frameworks with text-based source code. Our AI-based security analysis reviews code in its application context, so your team can use PR scanning and DeepScan across a mixed-language codebase.

We've built specific optimizations for the languages and frameworks below. DryRun automatically detects the language and framework in your repository and uses that context to tailor its review.

Language: JavaScript / TypeScript
Node.js, React, Next.js, Express (Express.js), Angular, Vue.js, React Native, and Expo.

Language: Python
Django, Flask, and FastAPI.

Language: Java
Spring Boot, Jakarta EE, and Android applications.

Language: Go
Go (Golang) source code.

Language: Ruby
Ruby on Rails and Sinatra.

Language: PHP
Laravel and Symfony.

Language: C# / .NET
.NET, ASP.NET Core, and .NET MAUI applications, plus .NET Framework and .NET Core codebases and libraries targeting .NET Standard.

Language: Kotlin
Android, Jetpack Compose, and Kotlin Multiplatform.

Language: Swift
SwiftUI and UIKit for iOS and other Apple platforms.

Language: Rust
Rust source code.

Language: C / C++
C and C++ source code.

Language: SQL
SQL queries and scripts.

Language: Bash / Shell
Bash and shell scripts.

Language: PowerShell
PowerShell scripts.

Language: Dart
Flutter applications.

Language: Objective-C
UIKit and Foundation for Apple applications.

Language: Elixir
Phoenix and Phoenix LiveView.

Language: Erlang
Erlang/OTP applications.

Language: Scala
Play Framework and Akka HTTP.

For another language or framework, show us your stack. Our AppSec team can help evaluate your application and work with you on additional optimizations. We can also discuss whether improvements relevant to your stack are already on our roadmap and how your needs can inform their priority.

For dependency scanning, the language support documentation lists the package manifests and lock files covered by SCA.

DryRun Security supports GitHub.com and GitLab.com, along with GitHub Enterprise Server and GitLab Self-Managed. Connect the repositories your team wants reviewed through the appropriate installation flow. Self-managed source control setup includes coordination with our team on connectivity and access.

The Quick Start guide explains the supported platforms and administrator permissions. For another source control system, discuss the integration with us before planning your rollout.

DryRun Security connects to GitHub or GitLab and reviews changes in the pull request or merge request workflow. On GitHub, installation uses the DryRun Security GitHub App. GitLab setup uses the access and account configuration described for your hosting environment in the installation guide.

The review sits alongside your build and test pipeline. Configure DryRun as a required security check when you want its results to control merging, and keep your existing CI checks in place. The PR scanning documentation explains what is reviewed and how results reach developers.

DryRun Security has maintained SOC 2 Type II compliance for three years and completed three independent audits.

Your GitHub or GitLab installation controls which repositories DryRun Security can access, and you can revoke that access in source control. Analysis uses ephemeral workloads and private model infrastructure. Customer data is not shared with other customers or used to train third-party models.

DryRun retains security findings and related metadata, together with context markers used for later analysis. That is different from retaining a copy of your entire codebase. Our code safety practices explain these boundaries and the quarterly third-party infrastructure assessments; an audit letter is available on request.

Yes. DryRun Security has maintained SOC 2 Type II compliance for three years and completed three independent audits.

DryRun Security is delivered as a SaaS platform connected to your source control environment. Code reviews and retained security findings provide evidence of the application security controls your team operates. That evidence supports conversations about secure development and change control in programs such as SOC 2, ISO 27001, PCI DSS, and HIPAA.

Your compliance team determines which controls and evidence apply to its assessment. Review our code safety practices and discuss data handling and deployment requirements with us during procurement. The AISSMM field guide connects an AI software security program to ongoing governance and evidence.

Yes. We work with enterprise teams on private-model requirements. DryRun's analysis platform is model-independent, so the discussion can focus on the security task and the constraints of your environment rather than committing your review process to one general-purpose coding model.

Contact our team with the model provider, hosting requirements, and data-handling constraints you need us to evaluate. We will establish the supported deployment approach with you. Our code safety page describes the privacy practices of the standard service.

DryRun retains security findings and review context that help your team explain how it evaluates code changes. Instead of reconstructing every decision from a pull request thread, AppSec can use the platform's reporting and Security Intelligence to investigate findings and document the work performed.

The Insights MCP integration makes that information available to supported assistants for investigation and reporting. Your team selects the evidence its auditor requires, including how policies are enforced and how findings are handled. The AISSMM guide explains how continuous security review supports program governance.

DryRun Security combines seat-based pricing for committers with usage-based pricing for DeepScan and additional analysis. We do not bill by model tokens. Our pricing is built around the security outcomes your team needs, with commercial terms tied to the developers using the platform and the analysis your organization runs.

The goal is a predictable transition from your existing SAST tool and a practical way to secure AI-assisted development, without exposure to unpredictable token bills. In a customized pricing conversation, we work through your committer count and repository mix alongside the DeepScan and analysis usage you expect. That gives your team a clear basis for planning the rollout and its budget.

Yes. DryRun Security brings AI code review and SAST together with software composition analysis (SCA), Dependency Exploit Validation (DEV), and secrets scanning. Consolidating overlapping tools can free up budget for independent verification of AI-generated code and reduce the work of operating several separate security workflows.

If you already budget for GitHub Advanced Security, Snyk, Socket, or other code and dependency scanning tools, bring that spend into the evaluation. We can map the capabilities your team uses to DryRun's coverage and identify which subscriptions you can replace. Where that removes overlapping spend, moving to DryRun can lower your total AppSec cost while adding contextual analysis and dependency exploit validation.

Compare the findings on your own repositories and the remediation workflow alongside the commercial proposal. Our capability matrix helps frame the comparison, and our team can work through a consolidation plan that fits your existing budget and rollout priorities.

Start with a security assessment or book a 15-minute demo with an AppSec expert. We will help you connect an appropriate repository, establish its security baseline, and examine the results with your team.

Use the evaluation to follow a finding through the whole workflow: understand the risk, make a repair, and review the resulting change. Bring a representative application and the security requirements you want to enforce. That gives you concrete evidence for deciding how to roll DryRun out across your engineering teams.