Setup is a one-time process, and any new repos are scanned automatically. Findings appear as PR comments, which makes them easy for developers to notice, review, and act on.

Deepscan feels like a step forward for establishing a baseline for repo security standards and for uncovering issues in legacy repos. Review collected by and hosted on G2.com.

The management portal is still slow to use, and the loading time is noticeably slow by modern standards. Review collected by and hosted on G2.com.

DryRun Security easily integrates into our existing build pipeline so that scans happen automatically and our developers get near real-time feedback on vulnerabilities in their code. Review collected by and hosted on G2.com.

There is nothing that I really dislike about DryRun Security. Even in situations where I've found what I believed to be a bug in the product, they were very quick to investigate and come back to me with a solution. Review collected by and hosted on G2.com.

DryRun has been a strong force multiplier for our AppSec process. It analyzes changes in context (not just pattern matching), flags issues early in pull requests, and delivers feedback in a way engineers can act on quickly. We’ve seen fewer false positives vs. legacy SAST approaches, which makes it easier to build trust with dev teams. Review collected by and hosted on G2.com.

Full-repo scanning is an area I’d like to see expanded. I know it’s already on the roadmap, and I’m looking forward to deeper whole-repository coverage in addition to PR/change-based analysis. Review collected by and hosted on G2.com.

I use DryRun Security to look at my code for security vulnerabilities. It helps me deliver secure code to production, and I love its ease of use as it already plugs into the workflow I am used to. It's fast and lets me keep on working without having to compile my code and wait hours for a scan to finish. DryRun looks at my changes in the PR and determines if we are introducing risks to our application. The initial setup was really easy. Review collected by and hosted on G2.com.

There isn't anything to dislike Review collected by and hosted on G2.com.

DryRun Security runs and provides feedback where we do our work: GitHub. Feedback is provided quickly within the context of the Pull request. This helps our team mitigate vulnerabilities before they are deployed.Vulnerabilities are reported in a context-aware manner, which reduces the number of false positives. Review collected by and hosted on G2.com.

Pricing requires contacting the team, and I typically prefer transparent pricing models. With that being said, the team is incredibly helpful, and quick to turn around price quotes. Review collected by and hosted on G2.com.

I like DryRun Security for its ease of use, even when managing hundreds of repositories. I appreciate that security findings are surfaced directly to the engineer in the GitHub comment with valuable context. This context is crucial as it helps engineers understand the true root causes and risks, beyond just fixing another bug. Setting it up was as simple as installing a GitHub app. Review collected by and hosted on G2.com.

Everything thus far has been working as expected. In terms of improvement, support monolithic repos would be the most helpful thing, but I know that feature is coming soon. Review collected by and hosted on G2.com.

DryRun security gives us a ton of context and intelligence around our code security that typical scanners don't give us. Review collected by and hosted on G2.com.

Nothing comes to mind. We use this for internal security and customer security facing reports. Review collected by and hosted on G2.com.

DryRun helps us keep up with the pace of AI code generation while ensuring that any code our developers check in goes through a security review before it’s merged. Review collected by and hosted on G2.com.

To get the most out of this product, as with any product, you need to devote time to working with it. The out-of-the-box policies are solid, but with a bit more time we could write more natural-language code policies tailored to specific use cases. Review collected by and hosted on G2.com.

Since its agentic and doesn't depend on rules, theres good coverage across any language, framework, or tool out of the box. It's been particularly helpful providing feedback to engineers on changes to infra level concerns like terraform or helm. Review collected by and hosted on G2.com.

No major downsides, just needs some refinement as it grows. Slack alerts can be a bit noisy, for example. Thus far the team has sought feedback frequently and eventually comes up with solutions. Review collected by and hosted on G2.com.

DryRun is better than any static code analyzer we’ve used. It consistently surfaces real security concerns in PRs, provides helpful context, and makes the findings actionable. Review collected by and hosted on G2.com.

The scans can be a little slower compared to a static analyzer which is expected and acceptable. Review collected by and hosted on G2.com.