DryRun Security

DryRun Security offers a drop-in solution that injects security context as developers write code, so they can focus on writing code without having to be security experts. The company developed the tool based on its experience training more than 10,000 developers and security professionals in application security testing and security product development at GitHub and Signal Sciences.

DryRun Security solves real problems in the development workflow:

• Security Code Reviews are Slow: Code reviews are a bottleneck for the development team and often happen too late in the development pipeline.
• Security Context is Missing: Developers need security context as soon as a pull request is opened, so they can understand the impact of the code change that's about to be merged.
• Burdened Developers: The 'shift left' security tools can lead to bloated build times and confusing results.

The company's AI-powered Security Buddy uses Contextual Security Analysis to assess each pull request, delivering results fast and accurately. This approach collects the important aspects of a change before it's merged and presents the analysis directly in the pull request for the developer. Supported languages and frameworks include Python, Java, JavaScript/TypeScript, C++, C#, Golang, Rust, Swift, PHP, Ruby, Kotlin and Scala.

Among DryRun Security's features are:

• Contextual Security Analysis: Assesses code changes using the SLIDE model (Surface, Language, Intent, Detections, and Environment) to assess risk.
• Security Buddy: Looks for authentication and authorization, sensitive code paths and functions, authorship and intent, and code brittleness.
• Fast Code Reviews: Offers ridiculously fast code reviews in seconds so teams can have confidence to merge quickly.
• Easy Installation: Installs in less than a minute as a GitHub App.
• Developer Productivity: Increases developer productivity by accelerating the development pipeline velocity.

DryRun Security is designed to work with GitHub repositories and has a simple installation process. The tool is designed to give security context in the pull request, so developers can get feedback in near real-time without slowing down the development pipeline.

Published on June 9, 2024