CI.01
Commit and PR scans
Install the GitHub Action to scan on commit or pull request and return findings while the code is still in review.
FEATURES
The operating system for continuous vuln discovery
Find more real bugs. Spend less time triaging noise.
ZeroQuarry combines multi-agent vulnerability research with the workflows security teams already use: commits, pull requests, scheduled jobs, disclosure inboxes, and patch review.
scan://zeroquarry/features
ACTIVE
multi-agent triage
red team
vendor review
human control
github action + bot PRs
scheduled delta scans
model routing by phase
disclosure inbox automation
01 · Agent guardrails
Multi-agent review
that can keep arguing.
ZeroQuarry does not stop at a single plausible finding. It uses adversarial review to force evidence, rebuttals, and tighter severity before a result reaches your team.
Red team finds. Vendor team falsifies. You stay in control.
The red-team agent hunts for exploit chains and working proofs. The vendor-team agent tries to disprove each claim, challenge impact, and narrow remediation. That debate acts as guardrails against hallucinated or over-scored findings.
When the first pass is not enough, tell the agents to continue the debate. Push on a premise, ask for a better PoC, request an alternative patch, or keep triage running until the evidence is strong enough for your security bar.
red BOLA chain survives auth model check
vendor tenant guard only covers list endpoint
you continue debate: prove write impact
red PoC mutates invoice owner via PATCH
verdict exploitable · patch drafted · severity adjusted
02 · Development pipeline
Hooks into commits,
PRs, schedules, and fixes.
Run ZeroQuarry where code already changes. It can scan automatically, propose fixes, and keep checking the parts of the estate that moved.
CI.02
Auto-fix workflows
Let ZeroQuarry draft narrow patches for confirmed issues, ready for engineering review instead of another ticket handoff.
CI.03
Bot-authored PRs
Install the bot to suggest pull requests directly, with context from the finding and the remediation debate attached.
CI.04
Scheduled delta scans
Run periodically and efficiently scan what changed since the last pull, so repeated coverage does not mean repeated waste.
03 · Token optimization
Route the expensive model
only where it matters.
Different scan phases need different reasoning budgets. ZeroQuarry lets you pick the model for triage, validation, and PoC generation separately.
Triage
Cheap, broad search
Use lower-cost models to fan out over repositories, endpoints, binaries, and suspicious paths.
->
Validation
Skeptical review
Promote only promising candidates into adversarial validation and evidence checking.
->
PoC
Premium reasoning
Spend stronger models on exploit construction, impact analysis, and patch quality.
04 · Disclosure tracking
Your vulnerability inbox
becomes actionable.
Track the disclosures you send and the disclosures you receive. ZeroQuarry keeps the record, the evidence, and the follow-up work together.
forwarded email
Possible IDOR in invoice export
ZeroQuarry extracts the claim, maps affected assets, launches the appropriate scans, and prepares the response context your team needs.
Forward a disclosure. Let the agents do the first pass.
When you receive a vulnerability report, forward the email to ZeroQuarry. The system analyzes the disclosure, identifies relevant repos or live targets, runs appropriate scans, and helps separate valid reports from vague or non-reproducible claims.
For outbound work, keep a history of disclosures you have made: affected product, timeline, status, evidence, PoCs, and communications. The same agent loop that validates findings can help prepare clearer disclosure packages.