01
Generated patch revisions
Create a unified diff, review it, give feedback, and generate a new revision without granting repository write access.
Vulnerability remediation
Close the distance between evidence and a reviewed fix.
Generate focused diffs, stage audited auto-fix proposals, open pull requests through ZeroQuarryBot, or hand findings into the team’s ticketing system. Retest the result in the same lineage.
Generated patch revisionsApproval-gated GitHub PRsFocused retesting
remediation://controlled-changeprocessing
ZQ-2042jwt.verify() accepts HS256 + RS256 with one key — forged token reached /api/account as admin
auth-svc/middleware/jwt.tscritical · patch drafted
- jwt.verify(token, publicKey)
+ jwt.verify(token, publicKey, { algorithms: ["RS256"] })
CI
human review
merge
retest
ZeroQuarryBot proposes · your gates and merge authority decide
Capabilities
Fixes arrive as proposals, not commits
Security automation should save effort without approving production changes on its own. ZeroQuarry separates generation, repository permission, operator approval, CI, and merge.
02
ZeroQuarryBot pull requests
Install a GitHub App on selected repositories and open audited PRs from approved proposals.
03
Layered safety controls
Use account and repository kill switches, explicit enrollment, base-branch settings, file deny-lists, size limits, and push caps.
04
Optional auto-push
After a successful manual workflow, selected repositories can send qualifying proposals straight to PR review without auto-merging.
05
Ticket handoff
Create Jira or ServiceNow work, or open a prefilled GitHub Issue when code changes are not the right first step.
06
Explicit finding rechecks
Ask an update scan to retest unresolved lineage findings and record each one as fixed, still present, or inconclusive with current evidence.
How it runs
Validate, propose, review, retest
Generation is automated. Repository permission, approval, CI, and merge stay with you.
Validate
Confirm the vulnerability applies to the product before generating or filing remediation work.
Propose
Generate a patch, auto-fix proposal, or ticket with source, impact, proof, and expected outcome.
Review
Use normal engineering ownership, CI, branch protection, and code-review controls.
Retest
Verify the risk after merge; do not infer a fix merely because a previous finding is absent from a new scan.
Outcomes
Engineer-ready fixes, verified closed
Less back and forth between a finding and a merged patch, plus proof that the fix held.
Engineer-ready work
Reduce the manual translation from vulnerability narrative to code path, reproduction, and candidate change.
Controlled automation
Get the speed of generated fixes while preserving explicit repository gates and human merge authority.
Verified closure
Differentiate “a fix was merged” from “the security risk was actually retested.”
Evaluation FAQ
Questions about automated fixes
Auto-merge, the GitHub App, and how to stop the bot in a hurry.
Does ZeroQuarry auto-merge security fixes?
No. ZeroQuarryBot opens pull requests; your repository’s reviewers, CI, branch protection, and merge policy remain in control.
Do we have to install the GitHub App to get a patch?
No. Patch generation can produce a downloadable or revisable diff without repository write access. The GitHub App is only needed for the pull-request workflow.
How do we stop the bot quickly?
An account-wide kill switch stops all pushes, and each repository has its own kill switch. Repository enrollment and GitHub App access add separate permission gates.
Related workflows
Retesting and evidence
Watch a finding become a merged fix
Take one validated finding through proposal, review, and retest inside your own repository.