Scanning should keep up with your code without anyone remembering to press a button. This release adds automations: rules a project admin turns on to launch scans on their own. Our analysis flows keep getting sharper too.
Put your scans on autopilot
Turn on an automation for a repository and choose what triggers it:
- On a schedule: daily, weekly, every two weeks, or monthly.
- On a new zkao release: whenever we ship an update, a fresh scan runs. Each release brings improvements to how we scan, including new models and sharper flows like snarksentinel, gestalt, and cryptopsy, so an automated re-scan can surface issues earlier passes missed, even on a commit you have already scanned.
You can also tell an automation to keep scanning until a repository stops revealing new confirmed bugs, then pause itself. It stops once several scans in a row come back with nothing new, so it converges instead of running forever.
Automations respect a budget you set. Give your project a monthly credit cap for automated scans, and they pause for the rest of the month once they reach it, so automated scanning never runs away with your credits.
Everything is opt in. Automations exist only because you created them, they appear on your project dashboard and on the repository overview so you always know what is running, and project admins create and manage them in project settings.
Sharper analysis, more models
Our analysis flows keep improving at the part that matters most: staying on the code worth auditing and confirming real issues instead of noise. Flows including snarksentinel, gestalt, and cryptopsy got better at working through a large codebase in a deliberate order and building a clearer map of it before digging in, so they spend their budget where bugs actually live.
Scans also draw on a broader set of models now, with new providers and models added to the rotation. Every scan draws on a different mix, each with its own strengths and blind spots, so running the same code through more than one scan remains one of the most reliable ways to surface more: a second pass sees the code through a different lens and catches what the first did not.
New documentation
There is now a full set of user documentation built into the app. It walks you through connecting a repository, launching your first scan, reading and triaging findings, and steering scans with a zkao.md, with screenshots of each step. If you are getting a team started on zkao, it is the place to point them.
Other changes
- The new-scan page now remembers the budget you last used for each repository and scan type, and offers quick chips to reset it to the minimum or back to that last value.
- Your API and CLI access tokens now live in a dedicated Integrations section, reachable from project settings and a card on your dashboard.
- Projects can now keep a billing-CC list, so invoices and billing notifications reach the people you name beyond project admins, and invoice emails now carry the pay-to details.
- The new-version nudge that tells you a fresh scan could find more now lives alongside your repository status and can be dismissed per version, so it stays out of the way once you have seen it.
- Scans that we do not charge you for now clearly show as uncharged, so your credit history is easy to read.
- You can turn off the "scan finished with no findings" email per repository, while still getting notified for scans that do find something.
- Inviting someone to a project now emails them even if they do not yet have a zkao account, so nothing stalls waiting on them to sign up first.
- Flow names in a scan's timeline read as their proper names instead of internal slugs, and the "added repository" entry in your activity feed links straight to the repository.