01
GitHub Actions workflow
Install a maintained workflow that dispatches repository scans on pull requests, pushes, schedules, or manual runs.
Continuous application security
Review risk while the change is still small enough to understand.
Trigger AI code security reviews from GitHub Actions, the API, or a native schedule. Delta scans focus on changed files and nearby data flow while lineages preserve the wider product history.
PR and push triggersScheduled rescansChanged-code focus
automation://workstream-loopprocessing
ZeroQuarrytriage · review · retest
GitHubPR checks · issues · fixes
Humanreview · merge · decide
✉ researcher report
⑂ PR #248 opened
one workstream, looping: ZeroQuarry to GitHub to a human decision and back
Capabilities
Running review on every change without flooding CI
A full pentest on every commit would be wasteful. Teams need a reliable signal around high-risk changes, plus a path to deeper review when the signal warrants it.
02
Delta scans
Use Git history to focus the next assessment on changed files and adjacent data flow after the first baseline.
03
Native schedules
Attach daily, weekly, or monthly coverage to a Git lineage, skip unchanged commits, and optionally recheck unresolved findings.
04
Public API
Create, monitor, cancel, rescan, search, share, and export through the same account and tier boundaries as the console.
05
Practical gating
Start non-blocking, then gate on reviewed critical or high findings when the team understands the signal profile.
06
Notifications and handoff
Send completion summaries to email or Slack and move accepted findings into tickets or pull requests.
How it runs
From baseline to escalated release review
One broad assessment first, then pull requests, schedules, and API calls keep it current.
Baseline
Create the project and complete one broad source assessment for the repository.
Trigger
Dispatch on high-risk pull requests, main-branch changes, or an independent schedule.
Review
Validate important results and avoid treating an unreviewed model output as a release decision.
Escalate
Move consequential changes into a broader source, binary, or live-target release review.
Outcomes
Continuous coverage without continuous noise
Shorter feedback loops and controlled spend, with history that outlives CI logs.
Shorter feedback loops
Catch authorization, webhook, parser, billing, and tenant-boundary regressions before context disappears.
Controlled scan spend
Use change focus, no-change skips, deduplication, and stage-specific models to match depth to risk.
Evidence-backed remediation checks
Record each selected previous finding as fixed, still present, or inconclusive instead of treating absence from a new scan as proof of a fix.
Security history by product
Keep repeated assessments and retests in one project instead of burying evidence in CI logs.
Evaluation FAQ
Before you wire this into CI
Gating, what a delta scan really covers, and whether every pull request should block.
Should every pull request block on ZeroQuarry?
Usually not at first. Start with report-only visibility, learn the finding profile, then introduce a reviewed threshold for the branches and changes that justify it.
What is the difference between CI and scheduled scans?
CI associates security review with an engineering event. Schedules provide independent baseline coverage and only run a new scan when the repository commit changes.
Does a delta scan inspect only the edited lines?
No. Changed files define the focus, but agents can follow nearby calls and data flow when the security impact crosses the diff boundary.
Related workflows
Pull request and release review
Start with one repository and one week
Turn on pull request review, then decide whether the signal is worth gating on.