ZeroQuarry overview

ZeroQuarry is an AI security-operations platform for teams that need more security coverage than their headcount can provide. It turns product context and software assets into a repeatable operating loop:

1. Receive work from engineering, scheduled reviews, or forwarded security reports.
2. Assess the right surface: source, a shipped binary, or an authorized live target.
3. Decide what is real using evidence, adversarial review, finding states, and a recorded audit trail.
4. Move remediation into engineering through patches, auto-fix pull requests, Jira, ServiceNow, or GitHub Issues.
5. Prove the work happened with reports, controlled shares, disclosures, and an account-wide Evidence Room.

The assessment layer covers the assets teams actually ship and operate:

• source code repositories and uploaded source archives
• binary artifacts such as Android packages, JARs, firmware, installers, and archives
• authorized live targets such as web applications, APIs, and SaaS assets

The primary UI is the ZeroQuarry console at console.zeroquarry.com. Programmatic access is available through the public API gateway at https://api.zeroquarry.com.

The console opens into a project workspace where scan history, findings, and new assessment flows stay grouped by product or service.

New accounts start with a short workflow-mode setup step. This lets ZeroQuarry tailor the scan UI for a guided owner/operator experience, a security-research workflow, or an AppSec triage workflow before the first scan is created.

Why teams use ZeroQuarry

Use ZeroQuarry when software is changing faster than a human security team can manually inspect it, or when the company is not yet ready to staff every security specialty internally.

Common use cases:

• Release security review: scan a release branch, shipped artifact, and staging target before promotion.
• Continuous CI scanning: trigger source scans from CI and use delta scans to focus on changed code, or schedule lineage-aware rescans independently of CI.
• Inbound report handling: forward researcher or customer security reports into a project-specific inbox, constrain what may be scanned, and turn valid targets into assessment work.
• Triage and remediation: challenge findings, record accountable lifecycle decisions, generate fix patches or pull requests, and re-run after fixes.
• External disclosure: prepare exploit proofs, disclosure drafts, HackerOne review context, and a disclosure timeline.
• Customer and audit evidence: package the latest evidence for selected assets, or share only the findings a recipient should see.
• Multi-surface assessment: combine source, binary, and remote scans when a vulnerability crosses build, packaging, and runtime boundaries.

Start with Build a security operating rhythm if you are deciding where ZeroQuarry fits in your company. Use Choose the right assessment if the outcome is clear and you are deciding what to scan first.

Core concepts

Projects group scans for one product, service, repository, or target set. Every scan belongs to a project. Use projects to preserve history across source, binary, and remote reviews of the same product.

Scans are asynchronous security assessments. A scan has one mode: source, binary, or remote. Scans move through states such as queued, running, awaiting batch artifacts, completed, failed, or cancelled.

Targets are the concrete inputs for a scan: uploaded files, Git repositories, or URLs.

Findings are confirmed or candidate vulnerabilities recorded by the agents. Each finding includes severity, CVSS-style scoring, evidence, and source context where available.

Artifacts are generated outputs attached to findings, including proof of concept material, generated patches, and, when enabled, a draft disclosure email.

Reports are the durable review surface for a scan. Reports include findings, coverage notes, target metadata, logs, discussions, exports, re-run controls, and an audit log of analysis and finding-state changes.

Finding states record the human decision around a vulnerability, from candidate and validation through mitigation, retest, accepted risk, or archive. They are append-only decisions, not just mutable labels.

Shares expose only selected findings to a named recipient through an expiring, password-protected, read-only link.

The Evidence Room groups completed work by actual scan target and can build a combined PDF from the latest report for each selected asset.

Disclosures track externally reported issues across acknowledgement, fix, public advisory, bounty, credit, and closure.

How scans work

ZeroQuarry uses a coordinator and worker model.

1. The coordinator maps the target surface and builds a checklist.
2. Worker agents investigate focused areas, files, endpoints, or binary outputs.
3. Triage reviews recorded findings and filters weak or duplicate issues.
4. Artifact generation creates exploit proofs and disclosure drafts when the plan allows it.
5. Optional review passes can add HackerOne eligibility labels, independent challenge results, rebuttals, and confidence scores.

The result is a report that is intended to be actionable: evidence first, reproducibility where possible, and enough context for an engineer or security reviewer to decide what to do next.

How to read these docs

If you are planning a security program, start with a playbook:

• Build a security operating rhythm
• Release security review
• Continuous CI scanning
• Handle inbound security reports
• Triage to remediation
• Customer assurance and audit evidence
• External disclosure workflow

If you already know what asset you want to scan, go straight to the scan mode:

• Source code scans
• Binary artifact scans
• Remote target scans

If you are new to the console, run a small scan first:

Start with Run your first scan, then read the mode-specific page for the target you want to assess:

• Source code scans
• Binary artifact scans
• Remote target scans

For automation, choose GitHub Actions, scheduled rescans, or email triage based on what should create the work.