Feb 25th @ 1 PM ET
Security Reviews, IRL: Reviewing AI-Generated Code in Production
A live walkthrough of how real teams shipping real code use AI agents, PR reviews,and contextual security analysis to catch logic flaws and ship with confidence.
Most teams aren’t just reviewing human-written code anymore. They’re reviewing pull requests generated and modified by agents, shipped multiple times a day, and tied to complex authorization and multi-tenant systems.
Join leaders from Mallory and DryRun Security to walk through how PR review actually works in an AI-first codebase where manual review doesn’t scale and traditional SAST mostly adds noise. We’ll read real pull requests together, show the logic and authorization flaws that slipped past initial review, and break down why contextual analysis caught what pattern matching tools missed.
What you’ll see:
Join leaders from Mallory and DryRun Security to walk through how PR review actually works in an AI-first codebase where manual review doesn’t scale and traditional SAST mostly adds noise. We’ll read real pull requests together, show the logic and authorization flaws that slipped past initial review, and break down why contextual analysis caught what pattern matching tools missed.
What you’ll see:
Live PR reviews in GitHub, including agent-generated changes from tools like Claude,Cursor, and Devin
DryRun Security findings shown in context, focused on authorization flows, tenantboundaries, and logic flaws
Three real issues that almost shipped: a privilege escalation, a multi-tenant boundaryviolation, and a credential leak
.webp)
.png)
Jonathan Cran
Founder @ Mallory
Ken Johnson
CTO and Co-Founder @ DryRun Security
DryRun isn't your normal SAST, it's your dedicated secure code review agent who is never too busy for a security review. DryRun enables busy security professionals by screening out the noise, providing direct feedback to engineers where they work, and working as a force multiplier for AppSec teams.
.webp)
Kyle Rippee
Product Security Engineer
,
Tines
"At Commerce, we’re building AI-driven shopping experiences, and agentic checkouts are changing everything. We chose DryRun because OWASP LLM app risks are all about context, and we wanted to build security in from day one. DryRun outperformed every other tool we tested by far, and its contextual security analysis actually understands our code the way our engineers do.”
.webp)
Adam Dyche
Manager
,
Application Security Engineering, Commerce
“As we lean harder into AI-generated code and highly customized delivery environments for our customers, we need more than a traditional code scanner. DryRun Security lets us continuously understand and explain the security posture of what we’re building, internally and for Fortune 50 clients, in a way that actually maps to how modern engineering teams work. The combination of real-time, context-aware analysis and MCP capabilities gives us a path to turn raw findings into customer-ready artifacts and ongoing assurance. For us, DryRun Security is less ‘AI code review’ and more a core piece of how we’re building an AI-first security program going into 2026 and beyond.”
.webp)
Patrick McKinney
Vice President Security
,
Invisible Technologies
With DryRun Security, it feels like we’ve more than doubled our AppSec team. We can focus on the pull requests that truly matter, thanks to Code Insights. What’s more, our developers get instant, actionable guidance on writing secure code — it’s like having a security coach in every pull request. The tool has transformed how we approach application security, scaling our efforts without adding headcount or slowing development.
.webp)
Sean Holcroft
Application Security Architect
,
BrightHR
It's hard to imagine writing code at startup speed without it now.
Jonathan Cran
Founder
,
Stealth
With DryRun Security, we’ve transformed how we manage application security across our global development team. The GitHub integration ensures that our developers get precise and instant feedback directly in their workflow, enabling them to fix security issues without skipping a beat. The tool has not only helped us catch risks like hardcoded credentials early but has also fostered a culture of security among our developers. DryRun Security is an indispensable part of our AppSec toolkit.
.webp)
Gary Gonzalez
CTO
,
PlanetArt
As the Director of Operations and Security of a successful tech startup, I wear many hats. With DryRun Security's out-of-the-box analyzers, I’ve found I no longer have to read through 40 PRs a day to find the two that are doing something unexpected. This is how I was able to identify sub-domain registration code that was going to allow a non-compliant domain, which would have taken down our DNS database for our whole customer base.
Todd Bradfute
,
SimpleRose
I love seeing how their contextual analysis upends a lot of assumptions I had burned into my brain about the limits of automation. There are whole classes of vulnerabilities I used to dogmatically say required humans to detect that they are able to identify and that’s super-cool. It is rare that I’m so happy to be wrong.
Dan Cornell
CTO
,
Denim Group
We've been using the DryRun Security app for months, and we highly recommend it! It automatically evaluates every GitHub pull request, so we know the solutions we're delivering to our clients are covered, plus the results are wicked fast and fit our development team’s needs.
%20(1).jpg)
John Poulin
CTO
,
Cloud Security Partners
We’re a leading open-source application security team with lots of community support, and because of that growth, sometimes code reviews can get complicated. Using DryRun Security, I've found the allowed authors feature helpful as it flags sensitive file changes in pull requests submitted by the committers who aren't approved to change certain parts of the codebase. One of the other things I love about it is how we could quickly get up and running in just a couple of minutes.
%20(1).png)
Matt Tesauro
CTO
,
Defect Dojo
FAQs
Answers to Your Most Common Questions.
If we didn't get your question covered, reach out to us at hello@dryrunsecurity.com
View All
Review and prioritize the highest-risk issues
Within a few hours you’ll get the results and if you want, one of our top appsec experts will review the top issues with you and a provide a practical path to remediation. That’s it, no strings attached.
Run DeepScan Agent on your codebase
You kick off the scan from the dashboard. We monitor progress and handle any issues should they come up (don’t worry, they won’t!).
Connect your repo
You perform a 5-minute install in the GitHub or GitLab app for your repo(s). We’ll walk through permissions and keep the process simple.
Meet with a DryRun Security expert
Short discovery call to confirm repo scope and what you want to learn (auth, business logic, secrets, or all three).
When should I use a DeepScan Agent review instead of a PR review?
Use it when you need broader coverage, for example onboarding a repo, preparing for an audit, after major refactors, before a release, orwhen developers introduce a new language.
Many teams run DeepScan on a cadence per production repo (monthly/quarterly), at key release checkpoints, or when risk changes, for example after big dependency updates or major architectural changes.