Trusted by engineering and security teams including:

Understand what the change puts at risk.

A small diff can change who can access data, how a request is authorized, or where untrusted input goes. DryRun investigates the change alongside the surrounding code and retained application context.

Findings, code references, and fix guidance arrive in GitHub pull requests and GitLab merge requests. In DryRun, inspect the code location, exploitation scenario, and missing control behind a finding.

See how PR scanning works

DryRun PR details connecting a group messaging change to a broken access control finding and a code security summary.
A proposed change, its application context, and the security risk it introduces.
View finding evidence

From proposed change to reviewed repair.

  1. DryRun reviews the change

    Opening or updating a PR or MR starts an automated review with static checks, contextual investigation, and your security requirements.

  2. Apply your merge policy

    Findings feed the check result. Your configured thresholds and required source-control checks determine what can merge.

  3. Developers and agents repair

    A developer or coding agent makes the fix. DryRun independently reviews the updated code.

Choose what risk enters your codebase.

Your team sets the security requirements. DryRun checks the code against them.

Set your blocking threshold

Set the minimum finding severity that fails a DryRun check. Configure GitHub or GitLab to require a passing result before merge.

Configure merge blocking

Check your own requirements

Describe application-specific requirements in natural language, such as checking tenant ownership before reading an invoice. DryRun evaluates them alongside its security analysis.

Explore custom code policies

Fix findings in your coding workflow.

Built-in integrations bring DryRun's findings, security context, and fix guidance into your coding workflow. Flexible MCP, API, and skill support.

See AI-native remediation

  1. DryRun guides the fix

    Findings, security context, and repair guidance.

  2. Your developer or agent repairs

    The change stays in your coding workflow.

    • Codex
    • Claude Code
    • Cursor
    • Windsurf

  3. DryRun reviews the change again

    Your configured checks govern what can merge.

With DryRun Security, it feels like we've more than doubled our AppSec team.

Sean Holcroft

Sean Holcroft
Application Security Architect, BrightHR

Meet our customers

Your languages. Your workflow.

PR scanning supports all programming languages and frameworks with text-based source code. Connect GitHub, GitHub Enterprise Server, or GitLab and keep security feedback in the review workflow.

See language and framework support, PR scanning coverage, or the language support FAQ.

Review our code safety practices, discuss your setup, or ask about your stack.

    Review new code. Investigate existing code.

    PR reviews investigate proposed changes. DeepScan investigates the existing repository, including code untouched by the latest change. Both build and use your security context, carrying application knowledge into later investigations.

    Explore full-repository DeepScan or see the broader AI-native SAST approach.

    Explore codebase intelligence

      See a security review of your code.

      Bring a repository and your security requirements. See the findings, inspect the evidence, and put your merge policy to work.

      Get a Demo Read the PR scanning guide