01
Source code review
Trace authorization, data flow, unsafe parsers, secrets, dependency use, and business-logic failures across repositories or uploaded archives.
AI security testing
Test source, artifacts, and live behavior as one product.
ZeroQuarry combines AI code security review, binary analysis, and authorized live application testing so teams can follow vulnerabilities across build, packaging, and runtime boundaries.
Source repositoriesBinary artifactsAuthorized live targets
assessment://surface-mapprocessing
SOURCEauth/middleware.ts
BINARYrelease/app.apk
LIVEapi.product.com
ZEROQUARRYMulti-surface assessmentFollow risk across build and runtime boundariesactive
FINDINGcross-tenant read
PROOFrequest replay
SCOPEproduct / release 42
the target surface changes, the evidence standard stays the same
Capabilities
Three assessment surfaces. One evidence chain.
A source finding can disappear during packaging. Another issue may only become exploitable at runtime. Keeping every surface in one project makes those differences visible.
02
Binary analysis
Expand and decompile APKs, JARs, firmware, installers, and archives to review the artifact customers actually receive.
03
Live application testing
Probe web applications and APIs inside explicit host, authentication, and authorization boundaries.
04
Focused assessment notes
Give the coordinator product context, sensitive boundaries, and recent-change details without preventing broader investigation.
05
Multi-model orchestration
Resolve separate models for investigation, adversarial review, and artifact generation while keeping one report.
06
Project and lineage history
Group assessment versions by product or service and preserve targets, findings, retests, logs, and artifacts.
How it runs
A concrete path through the work.
ZeroQuarry automates investigation and coordination. Your team keeps control of authorization, risk ownership, and production changes.
Scope
Choose the product project, target surface, credentials, authorization, and business context.
Investigate
Coordinator and specialist agents map the target and follow high-value attack paths.
Validate
Triage, proof generation, and optional vendor-style review pressure-test the claims.
Act
Route accepted findings into fixes, tickets, retests, disclosures, or evidence packs.
Operational result
What the team gets back.
Useful coverage should lead to faster decisions, cleaner remediation, and evidence that holds up when someone asks for it later.
Broader product coverage
Review code, shipped artifacts, and live behavior without splitting history across unrelated tools.
More useful findings
Prioritize evidence, reachability, impact, and product context over pattern matches.
A repeatable assessment record
Keep every target, version, decision, and retest connected to the product it belongs to.
Details
Questions that come up in evaluation.
These are the product boundaries, controls, and operating details teams usually want to understand first.
Is ZeroQuarry a SAST or DAST scanner?
ZeroQuarry covers source, binary, and authorized live targets, but its workflow is closer to agent-led security research than a deterministic rule scanner. It investigates product-specific behavior and produces evidence for review.
Can it test private repositories?
Yes. Accounts can configure scoped HTTPS or SSH Git credentials, and CI workflows can reference the saved credential without placing it in the scan payload.
Can ZeroQuarry test production?
Remote testing requires explicit authorization and scope. Use a staging or production-like environment when active probes could create risk, and keep the allowed host boundary narrow.
Related workflows
Continue through the operating loop.
Start with one real security boundary.
Use the free trial on your own product, then decide whether the resulting security work is useful enough to keep.