This release expands how zkao searches for bugs, including on code earlier scans already examined. ZKAO Max gains two new analysis flows, coverage for formal verification and consensus gets deeper, and the rest of the product makes it faster to steer scans, understand their coverage, and triage what they find.
New ways to find what earlier analysis missed
ZKAO Max now includes two new flows:
- Lacuna finds shared blind spots and unstated assumptions left by earlier analysis.
- Many Eyes puts difficult claims and cross-component bugs to a panel of independent models. It leans on the growing pool of strong open-weight models, so the hardest questions get many more second opinions for the same budget.
The core presets are broader too. The standard ZKAO scan now includes Gestalt's cross-component attack-path analysis, and ZKAO Pro adds Cryptopsy's dedicated cryptographic review. Free Agent is better calibrated to project feedback, reducing repeated noise and spending more of its time on the leads that look real.
Lean, consensus, and current Aleo coverage
zkao can now audit Lean 4 and Mathlib projects, checking whether proven statements match their intended security claims and whether assumptions, encodings, or the trusted base leave important gaps.
Coverage for Byzantine-fault-tolerant consensus has expanded as well. Scans are better at finding safety and liveness failures across quorum logic, node recovery, certificates, state transitions, and committee changes.
Aleo and Leo analysis now reflects snarkVM 4.7.1 and V15 behavior, and arithmetic-heavy cryptographic analysis is more reliable.
Triage findings without breaking your rhythm
Changing a finding's status is now immediate. Pick a concise reason, move on to the next finding, and use Undo if you change your mind. The reason is recorded in the finding's comment thread, so the decision stays visible to the rest of the team and informs later analysis.
Keyboard shortcuts can apply a decision and advance through the queue. A dedicated Needs triage filter keeps the undecided backlog in view, and the same reason-based workflow works when updating findings in bulk. Controls pause while a menu, selector, or dialog is open, so typing cannot accidentally triage something underneath it.
API clients can send the same resolution reason when updating a finding. It is validated for the chosen status and recorded as a comment. Marking a finding as a false positive also leaves its severity unchanged, so the original assessment remains intact.
Sign in with GitHub or Google
The sign-in and invitation pages now offer GitHub alongside Google, and remember which method you used last. If authentication fails, a clearer error explains how to try again or choose the other method.
The Account settings page now shows every connected sign-in method in one place. You can connect or disconnect Google and GitHub while zkao makes sure you always keep at least one way back into your account. You can also edit your username, review the verified email addresses from your providers, and choose the primary email used for notifications and future invitations.
When GitHub could match more than one zkao account, zkao asks which account to use instead of guessing. Connection conflicts stay visible with guidance for resolving them.
A better home for context and guidance
Reference material can now be pasted directly as Markdown or uploaded as .md, .markdown, or .txt. These documents are available immediately, without waiting for processing.
Other repositories in the same project can be linked as reference repositories. Scans then see how the audited code is integrated and used, without pulling that code into the audit scope.
The repository Context tab has been rebuilt around a reference-document sidebar and a main guidance workspace. Scan questions can now offer multiple-choice answers with an optional note, making it quicker to supply precise threat-model context without losing nuance. Guidance suggestions edit the repository guidance directly, keeping the source of truth in one place.
Clearer reasons to scan, and clearer coverage afterward
Repository pages now explain what a new scan could add: commits that have not been covered, zkao releases shipped since the last scan, or a deeper scan tier the repository has not tried. The scan page shows the tier that ran and offers the next deeper option when one is available.
Coverage is now broken down by bug-finding flow, and each phase shows which context documents it consulted. Repository activity includes scan starts, failures, and cancellations, with clearer links back to the affected repository and automation.
Redesigned public reports
Published scans, reports, and individual findings now share a cleaner, print-ready document design. Scan type, version, and date appear consistently, and you can copy a finding or an entire scan or report as Markdown for an issue, audit record, or team discussion.
More dependable scans and budget enforcement
Scans are now more resilient to retries, interruptions, and resource failures, preserving completed analysis more reliably without duplicating findings. Large scans also have more headroom and start their analysis faster.
Every part of a scan now respects the selected budget, including analysis that runs in parallel. If part of the selected analysis cannot run, its share is reallocated to the rest of the scan. A scan that fails because of enforced credit-budget exhaustion is refunded automatically.
Monthly hard-stop budgets now account for all committed scan spend, including reservations for running and automated scans and final charges still being processed, while refunds reduce the reported monthly spend. Auto top-ups and invoice credits now recover safely after interrupted processing. Automated scans stop before crossing the project's hard cap.
Other changes
- Scan history now distinguishes a committed
zkao.mdfrom settings guidance and shows how many project context documents a scan consulted, with a direct link back to that context. - The standard ZKAO scan now starts at 2,000 credits. The launch budget control shows each scan type's minimum first, followed by 2,500-credit breakpoints.
- API scan launches now return HTTP 402 when a project does not have enough available credits, making the failure distinct from an invalid request.
- Read-only API requests remain available when a project has no spendable credits.
- The project dashboard distinguishes available and reserved credits, and empty projects still show credits and team setup.
- Scan-list severity totals now respect the severity your team assigned during triage.
- zkao can now be installed from supported browsers and opened as a standalone app.
- Findings that describe null-byte edge cases in binary formats now save correctly instead of preventing a scan's findings from being recorded.
- When credit purchases are paused, project admins can still disable auto top-up or remove the saved card.