AUDIT SCAN
Point-in-time evidence
A useful checkpoint, but it only reflects the system at the moment of testing. New code and shipped artifacts keep moving.
CONTINUOUS TESTING
Find issues between audit windows
Scan when code actually changes.
ZeroQuarry turns vulnerability discovery into a recurring product workflow: commit scans, scheduled rescans, API-triggered jobs, delta focus, notifications, and project history that security teams can review later.
schedule://appsec
$ scan --on push --auto-delta true
ok changed files promoted to review
$ schedule --weekly sunday 00:00
ok no-change runs skipped
$ notify --slack --email
ok findings routed to team workflow
01 · Cadence
Move from annual review
to recurring coverage.
Traditional scans are usually scoped around compliance moments. ZeroQuarry is designed to run when risk changes: a push, a release candidate, a new binary, a reported issue, or a scheduled control check.
PR
Commit and PR scans
Run scans from CI while the code is still close to the developer review loop.
DELTA
Changed-file focus
Subsequent git scans can focus on diffs and follow adjacent data flow only where needed.
SCHED
Daily, weekly, monthly
Schedule recurring scans by local timezone and skip clean runs when nothing changed.
API
Programmatic starts
Use API keys to create scans, poll status, fetch reports, and wire ZeroQuarry into internal tooling.
02 · SOC 2 and AppSec
Evidence should not wait
for the next audit.
SOC 2 asks whether your organization has a vulnerability management process. ZeroQuarry gives teams a way to operate that process more often than a quarterly scanner or annual penetration test.
ZEROQUARRY
Recurring evidence
Scan histories, confidence, validation signals, exports, patch records, and project timelines show how the control operates over time.
APPSEC TEAM
Fewer handoffs
Security teams can route only the findings that survived review into tickets, PRs, and reports instead of re-triaging every scanner alert.
03 · Handoff
Continuous does not mean
constantly interrupting.
A scan is only useful if the output lands where work happens. ZeroQuarry connects scan completion, issue creation, patch review, and external sharing without forcing teams into another dashboard.
S
SLACK
Completion summaries
Post scan summaries to a configured Slack channel when a run completes.
J
JIRA
Issue creation
Create Jira work items from findings with deep context and links back to the report.
N
SERVICENOW
ServiceNow records
Open records on the right table for enterprise vulnerability management workflows.
G
GITHUB
Patch proposals
Stage patch diffs and open GitHub bot PRs only after human approval and safety checks.
E
EMAIL
Incoming report triage
Forward security reports to project addresses so approved senders can trigger target-matched scans.
A
API
Automation surface
Drive projects, scans, reports, disclosures, schedules, shares, and patches through JSON endpoints.