01
Hybrid static and agent analysis
Use a bounded deterministic SAST pre-pass to generate investigation candidates, then have agents test reachability, product context, control flow, and impact before recording findings.
AI security testing
Test source, artifacts, and live behavior as one product.
ZeroQuarry combines AI code security review, binary analysis, and authorized live application testing so teams can follow vulnerabilities across build, packaging, and runtime boundaries.
Source repositoriesBinary artifactsAuthorized live targets
assessment://surface-mapprocessing
SOURCEauth/middleware.ts
BINARYrelease/app.apk
LIVEapi.product.com
ZEROQUARRYMulti-surface assessmentFollow risk across build and runtime boundariesactive
FINDINGcross-tenant read
PROOFrequest replay
SCOPEproduct / release 42
the target surface changes, the evidence standard stays the same
Capabilities
Reviewing code, artifacts, and runtime together
A source finding can disappear during packaging. Another issue may only become exploitable at runtime. Keeping every surface in one project makes those differences visible.
02
Source code review
Trace authorization, data flow, unsafe parsers, secrets, dependency use, and business-logic failures across repositories or uploaded archives.
03
Binary analysis
Expand and decompile APKs, JARs, firmware, installers, and archives to review the artifact customers actually receive.
04
Live application testing
Probe web applications and APIs inside explicit host, authentication, and authorization boundaries.
05
Focused assessment notes
Give the coordinator product context, sensitive boundaries, and recent-change details without preventing broader investigation.
06
Multi-model orchestration
Resolve separate models for investigation, adversarial review, and artifact generation while keeping one report.
07
Project and lineage history
Group assessment versions by product or service and preserve targets, findings, retests, logs, and artifacts.
How it runs
Scope, investigate, validate, act
Source, binary, and live testing follow the same four steps, and every step writes to the same project history.
Scope
Choose the product project, target surface, credentials, authorization, and business context.
Investigate
Coordinator and specialist agents map the target and follow high-value attack paths.
Validate
Triage, proof generation, and optional vendor-style review pressure-test the claims.
Act
Route accepted findings into fixes, tickets, retests, disclosures, or evidence packs.
Outcomes
What changes after the first assessment
Fuller coverage of the product, and a record you can hand to someone else without rebuilding it.
Broader product coverage
Review code, shipped artifacts, and live behavior without splitting history across unrelated tools.
More useful findings
Prioritize evidence, reachability, impact, and product context over pattern matches.
A repeatable assessment record
Keep every target, version, decision, and retest connected to the product it belongs to.
Evaluation FAQ
Before you point it at a real repository
Private repositories, live targets, and how this differs from a scanner.
Is ZeroQuarry a SAST or DAST scanner?
ZeroQuarry combines a bounded deterministic SAST pre-pass with agent-led source investigation, binary analysis, and authorized live testing. Static matches are investigation candidates, not alerts presented as validated vulnerabilities.
Can it test private repositories?
Yes. Accounts can configure scoped HTTPS or SSH Git credentials, and CI workflows can reference the saved credential without placing it in the scan payload.
Can ZeroQuarry test production?
Remote testing requires explicit authorization and scope. Use a staging or production-like environment when active probes could create risk, and keep the allowed host boundary narrow.
Related workflows
Releases and pull requests
Run the first assessment on your own product
Point ZeroQuarry at one repository and see what a combined source, binary, and live review turns up.