ZeroQuarry ZeroQuarry
Sign in Start free trial ->
Browse ZeroQuarry
PRICINGAccount pricing. Not per-seat pricing.

Security leverageat developer-tool prices.

Try ZeroQuarry free for 30 days, then from $40 a month per account — not per seat. Collaborators, validation, reports, and evidence sharing are included; you spend credits only on the tests themselves.

Start free trial ->Compare plans
compare://developer-toolDIFFERENT
$ plan select developer --annual
$40/mo one account · three collaborators
$ run security-review --scope pr
validated finding · proof · patch · retest
$ export evidence --audience customer
ready this is security operations, not autocomplete
Plans

Start free. Expand when the work expands.

Free for open source

OSS

For maintainers validating incoming security reports against one qualifying public project.

$0/ month
No card · no fixed expiration
Protect an OSS project
  • 1 public project — GitHub, GitLab, Bitbucket, or Gitea
  • 5 creditsCredits are what you spend on testing: 1 for a pull-request or changed-file review, 5 for a full assessment. Reports, decisions, and sharing spend none. each month
  • 1 maintainer
  • Adversarial validation and retests
  • Report intake, disclosure tracking, and Linear filing
  • Bring your own model key
Build securely

Developer

For a founder or security-minded engineer adding independent review to one private product.

$40$50/ month
$480 billed yearly · save $120
Billed monthly · switch anytime
Start free trial
  • 1 private product
  • 10 creditsCredits are what you spend on testing: 1 for a pull-request or changed-file review, 5 for a full assessment. Reports, decisions, and sharing spend none. each month
  • 3 collaborators
  • Source, scheduled, and PR review, incl. dependencies and IaC
  • Adversarial validation and patch proposals
  • 5 controlled evidence shares
Most popular
Establish coverage

Coverage

For a team establishing repeatable testing, remediation, and evidence around one product.

$160$200/ month
$1,920 billed yearly · save $480
Billed monthly · switch anytime
Start free trial ->
  • 1 protected productOne product or service with its own codebase, release boundary, and evidence history. A monorepo can count as one; unrelated products with separate owners count separately.
  • 50 creditsCredits are what you spend on testing: 1 for a pull-request or changed-file review, 5 for a full assessment. Reports, decisions, and sharing spend none. each month
  • 15 collaborators, 3 concurrent assessmentsHow many assessments can run at the same moment, so a full review doesn't wait in line behind a pull-request check.
  • Source, binary, and authorized live testing
  • Jira and Linear routing, patches, and retests
  • 25 controlled evidence sharesA private, read-only link to specific evidence: named recipient, password-protected, expiring, and revocable. Share proof with a customer or auditor without granting account access.
Operate continuously

Operations

For teams running recurring review, inbound report triage, and remediation across several products.

$400$500/ month
$4,800 billed yearly · save $1,200
Billed monthly · switch anytime
Start free trial
  • 5 protected productsOne product or service with its own codebase, release boundary, and evidence history. A monorepo can count as one; unrelated products with separate owners count separately.
  • 200 creditsCredits are what you spend on testing: 1 for a pull-request or changed-file review, 5 for a full assessment. Reports, decisions, and sharing spend none. each month
  • 50 collaborators, 8 concurrent assessmentsHow many assessments can run at the same moment, so a full review doesn't wait in line behind a pull-request check.
  • Inbound report triage and GitHub autofix
  • Jira, Linear, ServiceNow, and custom reports
  • 100 controlled evidence sharesA private, read-only link to specific evidence: named recipient, password-protected, expiring, and revocable. Share proof with a customer or auditor without granting account access.
Standardize

Portfolio

For security teams standardizing decisions, automation, and assurance across a product portfolio.

$800$1,000/ month
$9,600 billed yearly · save $2,400
Billed monthly · switch anytime
Start free trial
  • 15 protected productsOne product or service with its own codebase, release boundary, and evidence history. A monorepo can count as one; unrelated products with separate owners count separately.
  • 600 creditsCredits are what you spend on testing: 1 for a pull-request or changed-file review, 5 for a full assessment. Reports, decisions, and sharing spend none. each month
  • 150 collaborators, 20 concurrent assessmentsHow many assessments can run at the same moment, so a full review doesn't wait in line behind a pull-request check.
  • Portfolio-wide triage, autofix, and reporting
  • Workspace appearance and priority rollout
  • 500 controlled shares, up to 365 days
Enterprise

Need private-network execution or a custom operating boundary?

Enterprise includes customer-controlled runner poolsA named set of scan runners inside your own network, on hardware you control. They reach private repositories and internal targets over outbound-only connections; only allowlisted finding metadata leaves. for private Git and authorized internal targets, with custom capacity, storage, procurement, assurance, and rollout terms.

Design Enterprise
Compare plans

Every limit, line by line.

CapabilityOSSDeveloperCoverageOperationsPortfolioEnterprise
Capacity
Protected productsOne product or service with its own codebase, release boundary, and evidence history. A monorepo can count as one product; unrelated products with separate owners count separately.1 public11515Custom
Credits / monthCredits are what you spend on testing: 1 for a pull-request or changed-file review, 5 for a full assessment. Reports, decisions, and sharing spend none.51050200600Custom
Concurrent assessmentsHow many assessments can run at the same moment. More concurrency means a full review doesn't wait in line behind yesterday's pull-request check.113820Custom
CollaboratorsPeople on the account. Everyone shares the plan's credits — there is no per-seat charge.131550150Custom
Assessment coverage
Public and private source reviewPublic onlyIncludedIncludedIncludedIncludedIncluded
Scheduled and pull-request reviewReview triggered by pull requests, pushes, or a schedule through a maintained GitHub Actions workflow. Changed files plus their data flow are scanned against a baseline; unchanged commits are skipped.Not includedIncludedIncludedIncludedIncludedIncluded
Dependency review and SBOM exportManifests and lockfiles are checked against OSV advisories, workers confirm reachability, and every dependency scan exports a CycloneDX or SPDX SBOM with dispositions attached.IncludedIncludedIncludedIncludedIncludedIncluded
Infrastructure-as-code reviewTerraform, Kubernetes, Helm, Dockerfile, and Compose are checked for insecure defaults — public exposure, embedded secrets, over-privileged pods — alongside your application code.IncludedIncludedIncludedIncludedIncludedIncluded
Release artifact and binary reviewReview of what you actually ship — APKs, JARs, firmware, installers, archives — not just the source that produced it.Not includedNot includedIncludedIncludedIncludedIncluded
Authorized live-application testingLike a DAST scan run by an investigating agent: it logs in and tests your running app inside documented host and authentication boundaries, reporting only what it can reproduce with proof.Not includedNot includedIncludedIncludedIncludedIncluded
Customer-controlled private runnersA scan runner inside your own network reaches private repositories and internal targets. Only allowlisted finding metadata leaves; evidence, logs, and artifacts stay in.Not includedNot includedNot includedNot includedNot includedIncluded
Adversarial validationBefore a finding reaches your queue, an independent reviewer agent tries to disprove it. Only findings that survive — reproducible, with evidence — get routed; the reasoning for rejected ones stays auditable.IncludedIncludedIncludedIncludedIncludedIncluded
Vulnerability PoCsEach finding ships a proof of concept: the request sequence or input that demonstrates the issue is real, not theoretical.Not includedIncludedIncludedIncludedIncludedIncluded
Security operations
Finding retestsAfter a fix lands, the original finding is re-tested and recorded as fixed, still present, partially fixed, or inconclusive.IncludedIncludedIncludedIncludedIncludedIncluded
Patch proposalsSuggested fixes arrive as pull requests your team reviews and merges through its normal process. Dependency-bump patches are generated deterministically, with lockfiles regenerated.Not includedIncludedIncludedIncludedIncludedIncluded
Linear issue creationFile validated findings as issues in your own Linear, with deep links back to the finding and its evidence.IncludedNot includedIncludedIncludedIncludedIncluded
Jira issue creationNot includedNot includedIncludedIncludedIncludedIncluded
ServiceNow issue creationNot includedNot includedNot includedIncludedIncludedIncluded
Inbound researcher-report email triageA project-specific intake address: allowlisted senders, approved targets, and every forwarded report becomes bounded, authorized testing work instead of an ambiguous email.Not includedNot includedNot includedIncludedIncludedIncluded
GitHub autofix with human approvalZeroQuarryBot opens audited patch pull requests on your repository. It never merges anything — your review, CI, and merge rules still decide.Not includedNot includedNot includedIncludedIncludedIncluded
Evidence and rollout
Controlled evidence sharesA private, read-only link to specific evidence: named recipient, password-protected, expiring, and revocable. Share proof with a customer or auditor without granting account access.Not included525100500Custom
Maximum share expiry—30 days60 days180 days365 daysCustom
Report watermarkRequiredNot requiredNot requiredNot requiredNot requiredCustom
Custom report brandingYour logo, colors, and formatting on exported penetration-test-style reports.Not includedNot includedNot includedIncludedIncludedIncluded
Workspace appearance controlsNot includedNot includedNot includedNot includedIncludedIncluded
Rollout and procurement supportSelf-serveSelf-serveStandardGuidedPriorityCustom
The difference

Every plan runs the same loop.

TEST

Find what ships

Review source, release artifacts, binaries, and authorized live behavior across the product boundary.

CHALLENGE

Pressure-test claims

Separate discovery from skeptical review, proof, confidence, and explicit human risk decisions.

REMEDIATE

Carry the outcome

Generate controlled patches, route ownership, preserve approvals, and verify the actual fix.

PROVE

Answer outsiders

Turn the same operating history into reports and controlled evidence for customers, auditors, and leadership.

Add capacity

Expand the constraint you actually hit.

Product coverage

+$80 / month

One additional protected productOne product or service with its own codebase, release boundary, and evidence history. A monorepo can count as one; unrelated products with separate owners count separately. on annual billing; $100 when billed monthly.

Assessment capacity

+$40 / month

Twenty-five additional credits on annual billing; $50 when billed monthly. A focused review spends 1 credit; a full assessment spends 5.

Pricing FAQ

Questions that come up before purchase.

What is a credit?

Credits are the unit you spend on testing. A focused pull-request or changed-file review spends 1 credit. A full source, binary, or authorized live assessment spends 5. Validation, decisions, reports, evidence sharing, and rerunning a stage inside the same assessment spend none — so the credit number on a plan is the number you can forecast against.

What counts as a protected product?

One customer-facing product or service with a coherent codebase, release boundary, and evidence history. A monorepo can still be one product; unrelated products with separate owners and risk decisions count separately.

Is this priced per seat?

No. Each listed price covers the whole account and includes multiple collaborators. Developer includes 3 people and Coverage includes 15, so inviting engineering, product, or leadership does not multiply the subscription bill.

Why does this cost more than one coding-agent seat?

A coding agent helps one developer produce code. ZeroQuarry independently tests the product, challenges vulnerability claims, retains risk decisions, moves remediation, verifies fixes, and produces evidence for customers and auditors. The entry price stays in developer-tool territory; the product outcome is a continuous security operation.

Is model usage included?

Hosted model input and output are metered separately from the subscription. With your own provider key, the LLM provider bills you directly and ZeroQuarry does not add those calls to its model-usage invoice; your ZeroQuarry subscription and credit limits remain unchanged. Private runners require your keys for every selected stage.

Can we add capacity without changing plans?

Yes. Add protected products or bundles of 25 monthly credits. If that becomes a recurring pattern, moving to the next plan will usually provide better economics and more operating controls.

Can ZeroQuarry support penetration test and compliance evidence?

Yes. ZeroQuarry assesses the authorized product boundary, challenges the findings, records the methodology and evidence, tracks remediation and retests, and produces the report. Any buyer-specific evidence requirements are captured during scoping.

Start with the product you are shipping now.

Try one private product for 30 days without a card. Choose a paid plan only after the workflow has earned a place in your security operation.

Start 30-day trial ->Talk to us