Release history for the zkao security scanner. The current version is v3.0.0.
v3.0.0FeatureCurrent2026-10-02
Organizations, Our Biggest Analysis Update, and the zkao Assistant
Organizations group your projects under one team and one credit balance. Plus the biggest change to how zkao finds bugs since we launched: scan types named for the job, three new techniques, scans that build on earlier analysis, new coverage for trusted execution and Noir, and an assistant that briefs you and answers in finding comments.
Organizations: your projects and repositories under one team, with organization-level roles and one credit balance shared by every project
Scan types named for the job: Quick Look and Deep Audit from one launch page, Continuous Testing and Dependency Watch turned on per repository from a monthly budget, and a project dashboard that shows which repositories have them on
Our biggest analysis update since launch: three new techniques, scans that build on earlier analysis, and coverage for trusted execution environments and Noir
The zkao assistant: a chat on every page, your dashboard included, that briefs you, answers questions about your scans, findings, and the docs, and proposes the next step
Tag @zkao or a teammate in a finding comment, and hand one finding or a whole scan's worth to your coding agent
Point a scan at the part of a large repository that matters, get every new repository analyzed for free when you add it, and meet Sniper, a new flow for the bugs that break everything. New Solana, Go, and protocol coverage. ZKAO Max now rotates its techniques and starts lower.
Scans can be pointed at a named part of a large repository instead of all of it
Every repository you add is analyzed at no cost in credits, and comes back with the areas an audit would work through, each one click from a scan
New coverage for Solana programs, Go, and handshake and key-exchange protocols
Sniper, a new analysis flow in ZKAO Max, goes after the most severe bugs in the code where a single mistake breaks everything
ZKAO Max rotates through its analysis techniques, one per scan, which lowers what a Max scan costs and gives a repeat scan a new angle
Our analysis flows keep improving, so scans find more, including in code earlier scans already looked at
A rebuilt launch page in three steps, a budget recommended from what your scans actually spend, and an invoice for every credit purchase
New analysis flows hunt audit blind spots, Lean and consensus coverage expand, and a faster triage workflow turns findings into decisions with less friction.
ZKAO Max adds Lacuna, which hunts the blind spots left by earlier analysis, and Many Eyes, which puts the hardest questions to a panel of independent open-weight models
New Lean 4 and Byzantine consensus coverage, plus analysis updated for current Aleo and snarkVM behavior
Faster finding triage with one-click reasons, instant Undo, keyboard shortcuts, auto-advance, and a dedicated needs-triage queue
Sign in with GitHub or Google, choose the right account explicitly, and manage your profile, verified emails, and sign-in methods
Direct Markdown context and linked reference repositories, clearer scan coverage, redesigned public reports, and stronger protection against interrupted or over-budget runs
Billing is now pure pay-as-you-go: buy prepaid credits, pay only for what a scan uses, and your credits never expire. No subscriptions. zkao also gets a dark theme, a refreshed look, and redesigned home, repository, and scan pages. Our analysis flows keep getting sharper.
Pay-as-you-go billing: buy prepaid credits that never expire, and pay only for what a scan actually uses, capped at the budget you set
New spend controls: a per-project monthly budget with alert thresholds, optional auto top-up, and a billing page that states plainly how much scans can still spend
A full dark theme with a light, dark, or system switcher, plus a refreshed look across the whole app
Redesigned repository, home, and scan pages: a ranked queue of what needs you when you sign in, and live progress on running scans wherever they appear
Sharper analysis: flows like snarksentinel, gestalt, and cryptopsy got better at staying on the code that matters and confirming real bugs, so a fresh scan can surface issues earlier passes missed
New automations launch scans for you: on a schedule, whenever a new zkao release ships, or until a repository stops turning up new bugs, all within a budget you control. Our analysis flows keep getting sharper.
New automations: opt in to launch scans automatically, on a schedule or whenever a new zkao release ships
Pick a cadence (daily, weekly, every two weeks, or monthly), or keep scanning until a repository stops revealing new confirmed bugs, all within a monthly credit cap you set
Sharper analysis: flows like snarksentinel, gestalt, and cryptopsy got better at staying on the code that matters and confirming real bugs, and scans now draw on a broader set of models, so a fresh scan can surface issues earlier passes missed
New user documentation walks you through connecting a repository, running a scan, and steering it with guidance
Launch scans, track them, and read or triage findings from your own code and CI with the new zkao API, TypeScript SDK, and command-line tool. GPT-5.6 joins the models we scan with, and our analysis flows got sharper at finding real bugs.
New zkao API and TypeScript SDK: launch scans, follow their progress, and read or triage findings straight from your own tooling and CI
A zkao command-line tool that does the same from your terminal, with JSON output for scripts
Hand it to your own AI coding agent: point it at the zkao agent skill and it creates a token and drives your scans and findings in plain language
GPT-5.6 joins the models we scan with, and because every scan draws on a different mix of models, running more scans of the same code finds more, on top of sharper snarksentinel, gestalt, and invarianthunter flows
Scope your API tokens to exactly what they can do, limit them to specific repositories, and adjust their permissions later
Steer scans with a zkao.md in your repo: it now shapes audit scope and threat model directly, repository and per-scan guidance layer on top of it, and our analyzers ask fewer questions you have already answered
Differential testing in testator: your crypto is now cross-checked against independent implementations of the same primitives, turning subtle correctness bugs into concrete, reproducible mismatches
Your zkSecurity audits, in zkao: audits we have delivered now appear as manual audit scans on your project, findings included, side by side with your automated scans
Re-check findings you fixed for regressions, get sharper results from improved analysis flows, let Calibration sharpen each repository's guidance from what scans learn, adjust a finding's severity when you disagree, and manage findings across branches.
Turn on the regression check when you start a scan to re-examine findings you marked resolved and flag any that have come back, linked to the original
snarksentinel, gestalt, and cryptopsy are better at finding real bugs, including on code earlier scans already looked at, and scans now put any leftover budget toward deeper bug hunting
Calibration: after a scan, zkao can ask you a clarifying question or suggest a specific edit to your repository's zkao.md guidance, with a reason and one-click accept
Set a finding's severity yourself when you disagree with the analysis, applied directly with the original rating kept alongside
Filter findings by branch, and see each branch's complete picture, including issues that recur from another branch or an earlier commit
Re-scanning after a small change now updates the initial repository analysis for just what changed instead of rebuilding it from scratch, so you pay far less when little has changed
Higher-signal findings that spell out the attack path, results ordered by real impact, parallel scans across your repositories on a smarter queue, private repositories without scary GitHub permissions, and README badges anyone can verify.
Higher-signal findings: gestalt spells out end-to-end attack paths, severities you can trust, no more noise from test scaffolding
Findings are now ordered by impact, so the scariest ones come first
Run scans on several repositories in the same project at once, on a smarter queue with fair scheduling and faster starts
Private repositories without scary permissions: connecting GitHub is now sign-in only
README badges that prove themselves: show your latest scan or scan count, scope a badge to a repository, and let anyone verify it
zkao 1.0: Now Public, with Solidity and Sharper Flows
zkao 1.0 is our move out of private beta into a public, generally available release: the main version of the product. Access stays curated, with every team reviewed before scanning. This release also adds Solidity and EVM coverage with runnable proof-of-concept exploits, sharper analysis flows that find and confirm more real bugs, and triage that reinvests unused budget into deeper validation.
zkao is now public: version 1.0, generally available, with access still curated and reviewed per team
Solidity and EVM smart contract scanning with proof-of-concept exploits
Sharper analysis flows: snarksentinel and gestalt find and validate more real bugs
cryptopsy now diffs implementations against their specs to catch subtle crypto bugs
Triage reinvests a scan's unused budget into deeper finding validation
A new gestalt analysis flow, an upgraded Anthropic analysis model, coverage expanding beyond ZK circuits into broader cryptography, per-repository pages, recorded manual audits by zkSecurity, and a redesigned public report experience.
New gestalt analysis flow runs in every scan type to catch more bugs
Upgraded to Anthropic's latest Opus 4.8 model for deeper reasoning
A credits-based scan budget you control, new Aleo/Leo and Plonky3 framework coverage, redesigned PDF-friendly reports, file coverage in the scan UI, and improved Circom scanning.
Credits model with per-scan budget slider and absorbed overages
New framework coverage: Aleo/Leo and Plonky3 AIR
Redesigned PDF-friendly scan reports with TOC and grouped agent activity
File coverage badges and tree panel in the scan UI
Improved Circom finding triage and cross-file navigation
