This release opens zkao up to your own tooling. Everything you do from the dashboard you can now do from code, your CI pipeline, or your terminal. Underneath, GPT-5.6 joins the models we scan with and our analysis flows keep getting better at finding real bugs.
Automate zkao with the new API and SDK
zkao now has a public API and a TypeScript SDK so scanning can live inside your own workflows. Kick off a scan when a pull request lands, wait for it to finish, then read the findings and act on them, all without leaving your pipeline. The SDK covers the full loop: list your repositories, launch a scan with the budget and scan type you want, poll or block until it completes, and list, read, comment on, re-rate, resolve, or publish findings.
import { ZkaoClient } from "@zksecurity/zkao-sdk";
const zkao = new ZkaoClient({ token: process.env.ZKAO_TOKEN, projectId });
const { scanId } = await zkao.launchScan({ repositoryId, creditBudget: 500 });
const scan = await zkao.waitForScan(scanId);
const findings = await zkao.listFindings({ scanId });
Prefer the command line? The zkao CLI wraps the same API and prints JSON, so it drops straight into scripts and CI steps:
npm install -g @zksecurity/zkao-cli
zkao scans launch --repo <repoId> --budget 500
zkao scans wait <scanId>
zkao findings list --scan <scanId>
Access is controlled by project API tokens you create and revoke yourself. Each token carries only the permissions you grant it, such as reading results, launching scans, or publishing, and you can restrict a token to specific repositories so it can never touch the rest of your project. Changed your mind about what a token should reach? Edit its permissions in place instead of issuing a new one.
Already working with an AI coding agent? Point it at the agent skill in the zkao-sdk repository and it can drive zkao for you in plain language. Ask it to read the skill and create a scoped token for your project, and it takes it from there: launching scans, following their progress, and reading or triaging findings on your behalf.
Sharper analysis, now with GPT-5.6
GPT-5.6 joins the set of models we scan with, adding a stronger engine for the kind of dense, adversarial reasoning that cryptographic and zero-knowledge code demands. Every scan draws on a different mix of models, each with its own strengths and blind spots, so running the same code through more than one scan is one of the most reliable ways to surface more: a second pass sees the code through a different lens and catches what the first did not.
The flows built on top of these models keep improving too, and this release closes the loop with you. zkao calibrates to your repository up front, and the signals you give it, the guidance in your zkao.md, the questions you answer, and how you triage and rate findings, shape what later scans prioritize. Flows including snarksentinel, gestalt, and invarianthunter got sharper at staying on the code that matters and confirming real issues, so a fresh look can surface things earlier passes missed, even on code they already covered.
Scans also draw on more of the context you already have. Your documentation, changelogs, prior audit reports, and any agent guidance you keep in your repository now inform the analysis, so it starts out knowing what your code is supposed to do.
Testator, our test-generation flow, learned differential testing. When your code implements a standard primitive that independent libraries also implement, testator now drives your implementation and theirs with the same inputs, from ordinary values to edge cases and mutated data, and investigates any disagreement as a potential bug. Subtle correctness issues that slip past ordinary tests surface as concrete, reproducible mismatches.
Guide your scans with zkao.md
A zkao.md file in your repository tells zkao what matters: audit scope, the threat model, assumptions to hold or scrutinize, and issues to leave alone. That guidance now shapes the audit overview directly, so analysis stays on the code you care about instead of wandering into tests, mocks, or out-of-scope modules.
You no longer have to commit it to use it. Repository guidance, set in a repo's settings, layers on top of any committed zkao.md for every scan, and on the launch page you can tweak guidance for a single run. Each layer extends the one beneath it rather than replacing it, and every scan shows which guidance it used. You can also read and update a repository's guidance over the API, so an agent or CI step that learns something worth remembering can write it back for every future scan.
Scans are also less repetitive: when zkao raises a clarifying question and you answer it, or your zkao.md already covers it, later scans stop asking.
Clearer budget guidance
A scan now tells you accurately when it ran short on budget. Before, we flagged this only when a scan's overall spend approached its cap, which could miss scans that finished under budget overall but still ran out of room where it counted. Now the scan page surfaces when the analysis was budget-constrained, and the launch page carries that recommendation into your next run, so a higher budget is one click away and deeper analysis isn't cut off.
Your zkSecurity audits, as scans
If zkSecurity has audited your code, those audits now live where your scans do. Each audit appears on your project as a manual audit scan: every finding from the report is a real finding in zkao, with its severity, affected code, and your team's response to each issue carried over, and the full report text attached to the scan. Triage and resolve them alongside what automated scanning finds, one place for everything we have found in your code. A source filter on your findings view lets you look at manual audits and automated scans separately, or together.
Approve the GitHub App's updated permissions
The zkao GitHub App now asks for read access to issues and pull requests, so scans can draw on the discussion around your code, not just the code itself. GitHub requires an account owner to approve permission changes, and until that happens scans on repositories under that account are blocked. Your launch page and repository cards tell you when approval is pending and link straight to the right page on GitHub. If you would rather not grant the new permissions, scanning continues with the access it already has.
Other changes
- The repository overview is redesigned around a clearer status view: whether your current commit is covered, findings grouped by where they stand (open, in progress, resolved), the severity breakdown, and how fresh your latest scan is, all at a glance. It also points out when a newer zkao version is available for a repository, so you know there is more to find on code you have already scanned.
- Repositories that change visibility on GitHub after you connect them are now handled gracefully: a repo that goes private is detected at launch and asks for the access it now needs, and a repo that goes public scans without requiring the GitHub App.
- Your dashboard and launch page now point out when a deeper scan tier is available for a repository, and stay quiet when the deeper tier would cost you nothing extra.
- When a subscription lapses and a project drops to the free plan, project admins are notified directly instead of finding out at their next scan, and the change is recorded in the project's activity feed.
- A repository you delete now stays recoverable for 30 days, then is permanently removed. The 30-day grace period was always there, but the final deletion now actually happens, and the interface says so.
- The GitHub connection state on a repository is much more specific: no access, rate limited, not found, and unreachable are now distinguished instead of one generic error, and a failed fetch no longer claims your branch is gone.
- Smaller improvements throughout: an "add repository" button and a first-repository prompt on empty projects, opening scans in a new tab with cmd or middle click, a modal explaining exactly why a scan launch is blocked, who started or cancelled each scan in the activity view, and the completion summary pinned above a scan's timeline.
- Fixes: navigating back after launching a scan or creating a project no longer bounces you forward in Firefox, the back button works across repository tabs, an invalid GitHub URL returns a validation message instead of an error page, and the dashboard no longer crashes on a repository with guidance set.