How MoonPay Securely Ships New Products Faster With depthfirst

MoonPay powers ramps, trading, commerce, and stablecoin infrastructure, connecting traditional payment rails with blockchains. MoonPay maintains a broad regulatory footprint, including a New York BitLicense, a New York Limited Purpose Trust Charter, and money transmitter licenses across the United States, as well as MiCA authorization in the EU.

Before depthfirst, John Iatridis used coding agents to understand unfamiliar applications, trace authorization and data flows, and investigate specific attack paths. He also built his own AppSec agents for repeatable application-security tasks.

The challenge was building something broad enough to provide strong security coverage across different languages. Building that in-house would also mean maintaining the agent harness, adapting it as models and techniques changed, and continually checking that it still covered the range of security issues MoonPay cared about.

For a lean application security team supporting MoonPay's entire engineering organization through hyper growth and scale, building and maintaining a comprehensive agentic security system would prove an unsustainable engineering burden on top of security work.

MoonPay uses depthfirst to secure its codebase and review all pull requests before they’re merged, identifying complex vulnerabilities such as missing authorization checks, access-control gaps, and business-logic errors.

Each finding explains what the relevant code is doing and what it is intended to do, before laying out the vulnerability, how it could be exploited, its potential impact, and the conditions that make exploitation possible. That context is especially useful when John is reviewing an unfamiliar application, because he can understand the issue without first reconstructing the surrounding application logic himself.

Security Reviewer applies the same analysis before code is merged. AI-assisted development has boosted productivity across MoonPay’s engineering teams, accelerating the release of new features and product lines, which has led to a significant increase in pull requests. Medium- and high-severity findings block merge, while developers can review a depthfirst finding, fix the issue, and push another commit. If the issue is resolved, the finding closes automatically.

MoonPay’s product security team also reviews depthfirst findings and recommended mitigations where needed, but cannot manually inspect every pull request. Security Reviewer gives them coverage across those changes while they focus their attention on findings that need deeper review.

When MoonPay reviews a new application, John uses AI to understand the architecture, map authorization and data flows, and investigate the paths most likely to carry significant risk. depthfirst runs in parallel across the rest of the codebase, giving him broader coverage while he focuses on the areas that require deeper judgment.

That parallel workflow compresses that work to 50% of what it used to take. By the time John has built enough context to evaluate the application, depthfirst has already surfaced findings he can validate and report. This helps MoonPay launch new products faster while meeting its high security bar.

MoonPay keeps human judgment at the center of every review and holds the engineers accountable for context retention and decisions. John still uses general-purpose agents for targeted investigation, while depthfirst handles repeatable analysis across the rest of the codebase and in pull requests. Together, that lets a lean application security team absorb unfamiliar applications faster and expand coverage without having to recreate broad, cross-language AppSec coverage in-house.