DRYRUN SECURITY VS TRADITIONAL SAST VENDORS IN RUBY ON RAILS

Summary from the TLDR InfoSec newsletter

This post compares DryRun Security's contextual scanner to Snyk Code, GitHub Advanced Security, Semgrep, and SonarQube in finding vulnerabilities in the intentionally vulnerable RailsGoat. The test PR included SQL injection, XSS, SSRF, IDOR, user enumeration, and hardcoded token vulnerabilities. DryRun was the only tool that found all the vulnerabilities, whereas Semgrep found 3/6, GitHub and Snyk found 2/6, and SonarQube found none.