01
GitHub Actions workflow
Install a maintained workflow that dispatches repository scans on pull requests, pushes, schedules, or manual runs.
Continuous application security
Review risk while the change is still small enough to understand.
Trigger AI code security reviews from GitHub Actions, the API, or a native schedule. Delta scans focus on changed files and nearby data flow while lineages preserve the wider product history.
PR and push triggersScheduled rescansChanged-code focus
automation://change-reviewprocessing
PULL REQUESTPR 248 / 7 files
SCHEDULEnightly baseline
RELEASEcandidate 1.14.0
ZEROQUARRYContinuous review coordinatorUse the smallest useful scope for each triggeractive
CHECKfocused review
HISTORYlineage v12
SIGNALactionable change
delta review keeps routine coverage fast without losing the baseline
Capabilities
Continuous testing without turning CI into an alert machine.
A full pentest on every commit would be wasteful. Teams need a reliable signal around high-risk changes, plus a path to deeper review when the signal warrants it.
02
Delta scans
Use Git history to focus the next assessment on changed files and adjacent data flow after the first baseline.
03
Native schedules
Attach daily, weekly, or monthly coverage to a Git lineage and skip unchanged commits automatically.
04
Public API
Create, monitor, cancel, rescan, search, share, and export through the same account and tier boundaries as the console.
05
Practical gating
Start non-blocking, then gate on reviewed critical or high findings when the team understands the signal profile.
06
Notifications and handoff
Send completion summaries to email or Slack and move accepted findings into tickets or pull requests.
How it runs
A concrete path through the work.
ZeroQuarry automates investigation and coordination. Your team keeps control of authorization, risk ownership, and production changes.
Baseline
Create the project and complete one broad source assessment for the repository.
Trigger
Dispatch on high-risk pull requests, main-branch changes, or an independent schedule.
Review
Validate important results and avoid treating an unreviewed model output as a release decision.
Escalate
Move consequential changes into a broader source, binary, or live-target release review.
Operational result
What the team gets back.
Useful coverage should lead to faster decisions, cleaner remediation, and evidence that holds up when someone asks for it later.
Shorter feedback loops
Catch authorization, webhook, parser, billing, and tenant-boundary regressions before context disappears.
Controlled scan spend
Use change focus, no-change skips, deduplication, and stage-specific models to match depth to risk.
Security history by product
Keep repeated assessments and retests in one project instead of burying evidence in CI logs.
Details
Questions that come up in evaluation.
These are the product boundaries, controls, and operating details teams usually want to understand first.
Should every pull request block on ZeroQuarry?
Usually not at first. Start with report-only visibility, learn the finding profile, then introduce a reviewed threshold for the branches and changes that justify it.
What is the difference between CI and scheduled scans?
CI associates security review with an engineering event. Schedules provide independent baseline coverage and only run a new scan when the repository commit changes.
Does a delta scan inspect only the edited lines?
No. Changed files define the focus, but agents can follow nearby calls and data flow when the security impact crosses the diff boundary.
Related workflows
Continue through the operating loop.
Start with one real security boundary.
Use the free trial on your own product, then decide whether the resulting security work is useful enough to keep.