01
Adversarial vendor review
A separate review pass checks reachability, context mitigations, intended behavior, evidence quality, and practical exploitability.
Adversarial validation
Make every finding survive a skeptical counterparty.
A confident AI can still be wrong. ZeroQuarry separates discovery from validation: researcher agents build the claim, vendor-style reviewers try to reject it, and rebuttal must answer with evidence or concede.
Evidence-first findingsVendor-style challengeHuman decision history
review://claim-challengeprocessing
CLAIMtenant boundary bypass
CONTEXTrole and deployment state
PROOFreproduction request
ZEROQUARRYSkeptical finding reviewA separate reviewer tries to break the claimactive
VERDICTsustained
CONFIDENCE0.91
DECISIONready for owner
severity says how bad; confidence says how likely the claim is to hold
Capabilities
False positives need a review process.
Instead of hiding uncertain alerts at an arbitrary score, ZeroQuarry records why a claim survived, changed, or was disputed.
02
Researcher rebuttal
The original side responds to the challenge with more evidence, revises the claim, or retracts it.
03
Confidence separate from severity
See how likely a finding is to survive review without confusing that judgment with potential impact.
04
Proofs and reproducible context
Attach PoCs, source locations, HTTP sequences, or deployable test packages when the assessment supports them.
05
Finding discussion
Ask follow-up questions, request different reproduction steps, or challenge assumptions over several rounds.
06
Lifecycle decisions
Record candidate, validated, disputed, mitigated, retested, regression, accepted-risk, and archived states with reasons.
How it runs
A concrete path through the work.
ZeroQuarry automates investigation and coordination. Your team keeps control of authorization, risk ownership, and production changes.
Claim
The assessment records technical impact, severity, affected surface, evidence, and reproduction context.
Challenge
A skeptical reviewer attempts to disprove the issue in the product's actual context.
Rebut
The researcher sustains, revises, or retracts instead of merely repeating the conclusion.
Decide
A human records the operating state and routes accepted work to the correct owner.
Operational result
What the team gets back.
Useful coverage should lead to faster decisions, cleaner remediation, and evidence that holds up when someone asks for it later.
Less alert fatigue
Engineering sees reviewed claims with a visible evidence trail. Unsupported suggestions are filtered out earlier.
Defensible decisions
Disputes and accepted risks carry reasons that can be understood later.
Safer external sharing
Challenge high-impact findings before they reach customers, vendors, or bounty programs.
Details
Questions that come up in evaluation.
These are the product boundaries, controls, and operating details teams usually want to understand first.
Does adversarial review guarantee a finding is correct?
No automated review can remove the need for product context and human judgment. It makes the validation process explicit and creates stronger evidence for that decision.
What happens to rejected findings?
They are not silently deleted. Review verdicts, rebuttals, confidence, and human lifecycle decisions remain visible so the outcome can be audited or revisited.
Can we ask the system to explain a finding differently?
Yes. Finding and report discussions can request a shorter engineer handoff, safer reproduction path, alternative PoC, or challenge to a specific assumption.
Related workflows
Continue through the operating loop.
Start with one real security boundary.
Use the free trial on your own product, then decide whether the resulting security work is useful enough to keep.