Deep Research,
But for Finding Bugs
AI agents that audit your cryptography code with the methodology our auditors use. They map the codebase, hunt with several independent techniques, and confirm what they find. Run a deep audit before you ship, or leave zkao testing every day.
Access is curated. We review and verify every team before enabling scans.
The methodology
From Repository
to Report
The same workflow as a traditional audit, without the waitlist. Start with a cheap pass, or go straight to a full audit.
Connect a repository
zkao maps it for free: what the project is, the areas an audit would work through, and the threat-model questions the code cannot settle on its own.
Pick the job
A quick pass while you build, a deep audit before you ship, or testing that runs every day. Scope it to the part of the codebase that matters.
Agents audit the code
Independent techniques attack it from different angles: tracing untrusted inputs, diffing code against its specs, building machine-checked models, and more.
Get confirmed findings
Each finding is deduplicated and checked, reproduced with a running proof of concept or verified against the code, with the exact lines and a fix.
Drag the table to explore · Select a research tool
Choose the job
A Scan for Every Stage
Each scan type is named for what you want done. Run any of them once, on a schedule, or on every new zkao release.
While you build
Quick Look
One cheap pass that hunts for broken invariants. For code you are still changing.
Before you ship
Deep Audit
A broad audit combining specialist techniques. The one worth reporting on.
Every day
Continuous Testing
Built to be left running. Each run takes the next technique in turn and picks up where it last stopped.
On every change
Diff Scan
Audits the commits between a base and a head. Launch it from CI with the zkao GitHub Action.
Every month
Dependency Watch
Finds known vulnerabilities your code can reach, fixes you have not taken, and updates that look backdoored.
After a fix
Regression Check
Confirms the fixes for resolved findings still hold, and reports any bug that came back.
Built from real audit work
Why zkao is Different
Most AI security tools blast you with hundreds of findings and call it a day. We took a different approach.
Built by Auditors
Graded by Real Audits
We are an audit firm first. When our auditors find a bug that zkao missed, we teach zkao to find it.
We Do the Scouting
The Whole Field, Tried for You
New models, harnesses, and tools appear every week. We try them on real cryptography code and keep the ones that find bugs.
Signal Over Noise
Precision, Not Volume
Findings are triaged and confirmed before you see them. If we report it, it's worth investigating.
Coverage
Cryptography Protocols & Implementations
zkao audits cryptographic protocols and their implementations: handshakes, MPC, consensus, trusted execution, and the cryptographic libraries and software built around them.
Workflow
Works Where You Work
- Diff scans from CI with the zkao GitHub Action, and the CLI and API for everything else.
- Hand one finding or a whole scan to your coding agent. It verifies each one and reports back.
- The zkao assistant briefs you on every page, answers questions about your scans, and replies when you tag @zkao on a finding.
- Organizations group your projects under one team, one set of roles, and one credit balance.
Your code lives in an ecosystem
05 / THE DEPENDENCY CITYContinuous Testing
Security That Compounds Over Time
A single AI scan explores one set of reasoning paths. Run it again and it explores others. Continuous Testing runs every day, rotates through its techniques, and remembers where each one stopped, so coverage builds with every run.
- A bug found in June might not have been detectable in January
- New techniques and patterns from our audits land in every scan
- Set it up once, and new findings arrive on their own
A product by zkSecurity
Find the Bugs That Matter
Run a deep audit before you ship. Keep testing every day. Make security part of the way you build.