DepthFirst

“It’s really good at giving you that context. That’s one of the best things.”

“Within just a few days, I can go from knowing absolutely nothing about an entirely new codebase to having credible findings to report.”

“Having depthfirst in place and operational during this high-intensity time proved to be a great decision. It allowed us to scale our team and ensure that the code quality, safety, and velocity were kept high.”

“We extended our AppSec program with depthfirst. Now we have an AppSec agent that covers our codebase and PRs day and night, which freed us up to work on higher leverage security initiatives.”

“depthfirst helps developers securely write and review each others’ code and helps the security team focus on the most important issues.”

“Is this actually exploitable? Are there actual risks from this code? That’s the expensive piece, and depthfirst is excellent at answering that.”

“depthfirst helps us make sure that the quality bar stays high, and that our developers do not introduce new high and critical vulnerabilities.”

“We turned on blocking mode and no one noticed. It just kept working. That’s exactly what you want from a firewall.”

“Agentic Pentesting is surprisingly good: it even found a vulnerability in a feature that had been part of Supabase for two years and had already gone through multiple rounds of pentesting.”

“Engineers are able to trust issues raised by depthfirst due to the accuracy and clarity of the findings, attack paths, and remediation guidance. This in turn improves velocity as development doesn't block on the security team's availability to review findings.”

“Since adopting General Security Intelligence and introducing its context-aware code reviewer into our workflow, we’ve increased our code-security coverage by 2x. Its ability to learn from our patterns, understand application semantics, and continuously refine recommendations has been invaluable. To date, we have addressed more than 70% of agent recommendations which has significantly strengthened our overall security posture”

“We use depthfirst’s threat model to better calibrate criticality ratings. Some vulnerabilities may be relevant in theory but aren’t relevant in our context, so the threat model helps align the findings with our judgment.”

“depthfirst felt like adding an autonomous senior product-security engineer. It quickly surfaced our top issues and got smarter over time by tracking context across scans, and it 2x'd the efficiency of our security engineering team”

“The consistency in code findings is also very nice. Every finding has very consistent language and phrasing. There’s no ambiguity. If one person reviews my PR, I’m not going to get different feedback than if another person reviews it. It’s consistent.”

“The comprehensiveness of the solution is the most important part from a product security perspective: knowing that there’s one thing looking at all the code and all the PRs and finding things.”

“In previous roles, we would always tell teams, “We can look at the design, but we don’t have the capacity to look at every single line of code.” I probably said that thousands of times. I spent years saying that couldn’t be done. Guess what? I was wrong.”

“Since adopting General Security Intelligence and introducing its context-aware code reviewer into our workflow, we’ve increased our code security coverage by 2x . Its ability to learn from our patterns, understand application semantics, and continuously refine recommendations has been invaluable.”

“I cannot believe it is actually picking up the PR description, correlating that with the code I changed, and putting two and two together to flag issues.”

“This is really cool, it is detecting not just security issues, but code quality issues too. It is making me write better code.”