Agentic remediation
Coding agents review depthfirst's pull request findings and implement fixes independently.
How Listen Labs Builds Safely at the Frontier of Agentic Software Development
Context-aware prioritization
depthfirst uses Listen Labs' threat model to calibrate finding criticality and help the team prioritize.
Full code coverage
depthfirst reviews every pull request and scans the codebase regularly for more complex issues.
At Listen Labs, we run a frontier agentic software development lifecycle. depthfirst allows us to integrate security reviews into it without slowing down or compromising on security.
About Listen Labs
AI-powered customer research for leading teams
Listen Labs uses AI to run customer research for some of the world’s largest companies, including Microsoft and Google. Teams use the platform to design studies, conduct interviews, and turn what customers say into evidence for product and business decisions. Handling customer and participant data makes strong application security essential to maintaining customer trust.
Agentic development
Listen Labs is operating at the frontier of agentic software development. Engineers define and supervise the work, while agents write pull requests, review and respond to comments, and implement changes before a human makes the final merge decision. That model increases the velocity and volume of code Listen Labs can ship, but sustaining it requires a security review process that fits the agents’ workflow.
Workflow
Coding agents fix security issues in pull requests
Listen Labs uses depthfirst for two complementary workflows: recurring code scans across its repositories and security review on every pull request. Together, they cover vulnerabilities in existing code and issues introduced as agents ship new changes. With depthfirst, Listen Labs can make security review and remediation part of the agentic development loop while handling the complexity of a rapidly growing codebase.
When depthfirst finds a security vulnerability, insecure dependency, or bug on a pull request, it adds comments with the relevant code context, the reason the issue creates risk, its potential impact, and remediation guidance. The coding agent that opened the pull request can read depthfirst’s comments, evaluate the issue, and implement the fix independently. Every finding, response, and code change stays attached to the pull request, giving engineers a complete record for final review.
The same coverage extends beyond current changes. Listen Labs runs full-repository scans regularly to identify vulnerabilities that made it into the codebase, and depthfirst prioritizes findings by severity and confidence to help engineers fix the most important issues first.
Prioritization
Threat-model context calibrates finding criticality
Precision is critical whether humans or agents are reviewing and fixing findings. Tobias Schindler, Founding Engineer at Listen Labs, was initially skeptical about adding another AI reviewer because other tools had generated redundant or inaccurate comments that misled agents and ultimately created more work for engineers.
depthfirst uses its understanding of Listen Labs’ code, infrastructure, and business logic to assess the exploitability of each finding and provide useful remediation guidance. Listen Labs can also fine-tune depthfirst’s prioritization with an editable threat model that captures its architecture, accepted patterns, and exposure. This makes structural non-issues explicit and reduces repeated findings for patterns the company has already determined are safe.
We use depthfirst’s threat model to better calibrate criticality ratings. Some vulnerabilities may be relevant in theory but aren’t relevant in our context, so the threat model helps align the findings with our judgment.
Operating model
Security keeps pace with agentic software development
Listen Labs has built an agentic software development lifecycle that enables the team to move quickly, but sustaining that model safely depends on security keeping pace with development and operating within the same workflow. depthfirst makes that possible, allowing Listen Labs to keep running its agentic development lifecycle while protecting the data entrusted to it by some of the world’s largest companies.