DepthFirst

“At Listen Labs, we run a frontier agentic software development lifecycle. depthfirst allows us to integrate security reviews into it without slowing down or compromising on security.”

“Our teams use the entire depthfirst suite. We have Dependency Firewall, PR reviews, code reviews, and Agentic Pentesting. That was what brought me to depthfirst: it covers the full cycle.”

“Having depthfirst in place and operational during this high-intensity time proved to be a great decision. It allowed us to scale our team and ensure that the code quality, safety, and velocity were kept high.”

“depthfirst helps developers securely write and review each others’ code and helps the security team focus on the most important issues.”

“Is this actually exploitable? Are there actual risks from this code? That’s the expensive piece, and depthfirst is excellent at answering that.”

“We turned on blocking mode and no one noticed. It just kept working. That’s exactly what you want from a firewall.”

“Agentic Pentesting is surprisingly good: it even found a vulnerability in a feature that had been part of Supabase for two years and had already gone through multiple rounds of pentesting.”

“Engineers are able to trust issues raised by depthfirst due to the accuracy and clarity of the findings, attack paths, and remediation guidance. This in turn improves velocity as development doesn't block on the security team's availability to review findings.”

“Since adopting depthfirst and introducing its context-aware code reviewer into our workflow, we’ve increased our code-security coverage by 2x. Its ability to learn from our patterns, understand application semantics, and continuously refine recommendations has been invaluable. To date, we have addressed more than 70% of agent recommendations which has significantly strengthened our overall security posture”

“I cannot believe it is actually picking up the PR description, correlating that with the code I changed, and putting two and two together to flag issues.”

“This is really cool, it is detecting not just security issues, but code quality issues too. It is making me write better code.”

“It’s really good at giving you that context. That’s one of the best things.”

“Within just a few days, I can go from knowing absolutely nothing about an entirely new codebase to having credible findings to report.”

“We use depthfirst’s threat model to better calibrate criticality ratings. Some vulnerabilities may be relevant in theory but aren’t relevant in our context, so the threat model helps align the findings with our judgment.”

“The consistency in code findings is also very nice. Every finding has very consistent language and phrasing. There’s no ambiguity. If one person reviews my PR, I’m not going to get different feedback than if another person reviews it. It’s consistent.”

“The comprehensiveness of the solution is the most important part from a product security perspective: knowing that there’s one thing looking at all the code and all the PRs and finding things.”

“In previous roles, we would always tell teams, “We can look at the design, but we don’t have the capacity to look at every single line of code.” I probably said that thousands of times. I spent years saying that couldn’t be done. Guess what? I was wrong.”

“Our engineers are able to fix issues as quickly as possible, almost as soon as depthfirst finds them.”

“depthfirst felt like adding an autonomous senior product-security engineer. It quickly surfaced our top issues and got smarter over time by tracking context across scans, and it 2x'd the efficiency of our security engineering team”