DryRun Security AppSec Agents vs Hardened malloc (2026)