1
Focused review
A pull request or changed-file assessment scoped to the code that moved.
PRICINGAccount pricing. Not per-seat pricing.
Security leverageat developer-toolprices.
Try ZeroQuarry for 30 days, cover a private product from $40 per month on annual billing, and invite the people who need the outcome. ZeroQuarry costs like a developer tool while doing the continuous testing, validation, remediation, and evidence work a coding assistant does not.
compare://developer-tool
$ plan select developer --annual
$40/mo one account · three collaborators
$ run security-review --scope pr
validated finding · proof · patch · retest
$ export evidence --audience customer
ready this is security operations, not autocomplete
The value metric
One unit buyers can forecast.
A security run represents reserved investigation capacity. It makes a five-minute PR check economically different from a full product assessment without turning every finding, report, or teammate into a surcharge.
5
Full assessment
A complete source, release artifact, binary, or authorized live target review.
0
Operational follow-through
Review stages, decisions, reports, evidence sharing, and in-assessment reruns.
Public plans
Land small. Expand when the security work expands.
Annual billing is exactly 20% less than monthly. Each price covers the account. Model usage remains visible and separate.
Free for open source
OSS
For maintainers validating incoming security reports against one qualifying public project.
$0/ month
No card · no fixed expiration
Protect an OSS project- 1 qualifying public project
- 5 security runs each month
- 1 maintainer
- Secure researcher-report intake
- Adversarial validation and retests
- 3 controlled evidence shares
Build securely
Developer
For a founder or security-minded engineer adding independent review to one private product.
$40$50/ month
$480 billed yearly · save $120
Billed monthly · switch anytime
Start free trial- 1 private product
- 10 security runs each month
- 3 collaborators
- Source, scheduled, and PR review
- Adversarial validation and patch proposals
- 5 controlled evidence shares
Most popular
Establish coverage
Coverage
For a team establishing repeatable testing, remediation, and evidence around one product.
$160$200/ month
$1,920 billed yearly · save $480
Billed monthly · switch anytime
Start free trial ->- 1 protected product
- 50 security runs each month
- 15 collaborators, 3 concurrent assessments
- Source, binary, and authorized live testing
- Jira routing, patches, and retests
- 25 controlled evidence shares
Operate continuously
Operations
For teams running recurring review, inbound report triage, and remediation across several products.
$400$500/ month
$4,800 billed yearly · save $1,200
Billed monthly · switch anytime
Start free trial- 5 protected products
- 200 security runs each month
- 50 collaborators, 8 concurrent assessments
- Inbound report triage and GitHub autofix
- Jira, ServiceNow, and custom reports
- 100 controlled evidence shares
Standardize
Portfolio
For security teams standardizing decisions, automation, and assurance across a product portfolio.
$800$1,000/ month
$9,600 billed yearly · save $2,400
Billed monthly · switch anytime
Start free trial- 15 protected products
- 600 security runs each month
- 150 collaborators, 20 concurrent assessments
- Portfolio-wide triage, autofix, and reporting
- Workspace appearance and priority rollout
- 500 controlled shares, up to 365 days
Enterprise
Design EnterpriseNeed custom capacity, assurance, or deployment review?
Custom products, runs, controls, storage, procurement, and rollout terms are available when the standard plans no longer fit.
The difference
A coding agent produces code. ZeroQuarry holds security accountable.
The pricing is intentionally comparable to developer AI. The job is not. ZeroQuarry maintains an independent product-security record from first test through external evidence.
TEST
Find what ships
Review source, release artifacts, binaries, and authorized live behavior across the product boundary.
CHALLENGE
Pressure-test claims
Separate discovery from skeptical review, proof, confidence, and explicit human risk decisions.
REMEDIATE
Carry the outcome
Generate controlled patches, route ownership, preserve approvals, and verify the actual fix.
PROVE
Answer outsiders
Turn the same operating history into reports and controlled evidence for customers, auditors, and leadership.
Compare plans
The whole package, line by line.
Every paid plan includes the core analysis loop. Higher plans add operating scale, automation, and coordination capacity.
| Capability | OSS | Developer | Coverage | Operations | Portfolio | Enterprise |
|---|---|---|---|---|---|---|
| Capacity | ||||||
| Protected products | 1 public | 1 | 1 | 5 | 15 | Custom |
| Security runs / month | 5 | 10 | 50 | 200 | 600 | Custom |
| Concurrent assessments | 1 | 1 | 3 | 8 | 20 | Custom |
| Collaborators | 1 | 3 | 15 | 50 | 150 | Custom |
| Assessment coverage | ||||||
| Public and private source review | Public only | Included | Included | Included | Included | Included |
| Scheduled and pull-request review | Not included | Included | Included | Included | Included | Included |
| Release artifact and binary review | Not included | Not included | Included | Included | Included | Included |
| Authorized live-application testing | Not included | Not included | Included | Included | Included | Included |
| Adversarial validation | Included | Included | Included | Included | Included | Included |
| Vulnerability PoCs | Not included | Included | Included | Included | Included | Included |
| Security operations | ||||||
| Finding retests | Included | Included | Included | Included | Included | Included |
| Patch proposals | Not included | Included | Included | Included | Included | Included |
| Jira issue creation | Not included | Not included | Included | Included | Included | Included |
| ServiceNow issue creation | Not included | Not included | Not included | Included | Included | Included |
| Inbound researcher-report email triage | Not included | Not included | Not included | Included | Included | Included |
| GitHub autofix with human approval | Not included | Not included | Not included | Included | Included | Included |
| Evidence and rollout | ||||||
| Controlled evidence shares | 3 | 5 | 25 | 100 | 500 | Custom |
| Maximum share expiry | 30 days | 30 days | 60 days | 180 days | 365 days | Custom |
| Report watermark | Required | Not required | Not required | Not required | Not required | Custom |
| Custom report branding | Not included | Not included | Not included | Included | Included | Included |
| Workspace appearance controls | Not included | Not included | Not included | Not included | Included | Included |
| Rollout and procurement support | Self-serve | Self-serve | Standard | Guided | Priority | Custom |
Add capacity
Expand the constraint you actually hit.
Add-ons support temporary launch, diligence, or portfolio pressure without forcing an immediate repackage. Persistent overage is a signal that the next plan will be more economical.
+$80 / month
One additional protected product on annual billing; $100 when billed monthly.
+$40 / month
Twenty-five additional security runs on annual billing; $50 when billed monthly.
$1,000 once
Scope, onboarding, first baseline assessment, and a working session around the resulting operating plan.
Model usage
Depth stays visible on the invoice.
Model input and output are billed separately from the subscription. Choose efficient models for routine change review and deeper models where the risk or decision warrants it.
Pricing FAQ
Questions that come up before purchase.
The commercial model should stay predictable, including the limits and usage charges that affect a production rollout.
What counts as a protected product?
One customer-facing product or service with a coherent codebase, release boundary, and evidence history. A monorepo can still be one product; unrelated products with separate owners and risk decisions count separately.
What consumes a security run?
A focused pull-request or changed-file review consumes 1 security run. A full source, binary, or authorized live assessment consumes 5. Reports, lifecycle decisions, evidence sharing, and rerunning a pipeline stage inside the same assessment do not consume more. Any newly started scan is metered by its scope.
Is this priced per seat?
No. Each listed price covers the whole account and includes multiple collaborators. Developer includes 3 people and Coverage includes 15, so inviting engineering, product, or leadership does not multiply the subscription bill.
Why does this cost more than one coding-agent seat?
A coding agent helps one developer produce code. ZeroQuarry independently tests the product, challenges vulnerability claims, retains risk decisions, moves remediation, verifies fixes, and produces evidence for customers and auditors. The entry price stays in developer-tool territory; the product outcome is a continuous security operation.
Is model usage included?
No. Model input and output are metered separately at the posted rates below, so you can match model depth to the decision and see the cost by scan. Keeping it visible also lets ZeroQuarry price the platform aggressively without hiding a usage assumption in every subscription.
Can we add capacity without changing plans?
Yes. Add protected products or bundles of 25 monthly security runs. If that becomes a recurring pattern, moving to the next plan will usually provide better economics and more operating controls.
Does this replace a human pentest?
ZeroQuarry creates continuous assessment and evidence between point-in-time tests. Some regulations, customers, or insurance policies may still require a named independent human assessor; we will scope those requirements honestly rather than treating every report as interchangeable.
Start with the product you are shipping now.
Try one private product for 30 days without a card. Choose a paid plan only after the workflow has earned a place in your security operation.