Big repositories no longer have to be scanned all at once. This release describes each repository as a set of named audit areas and lets you point a scan at the ones you care about. Adding a repository now produces that picture for free. ZKAO Max gains a new flow, Sniper, and rotates its techniques so a Max scan costs less and a repeat scan looks at your code a new way. Coverage grows for Solana, Go, and protocol design, and our analysis flows keep getting sharper.
Audit areas: scan the part of the codebase that matters
Large repositories are now described as a set of named audit areas, each one a subsystem with a short description of what it does. The new-scan page lets you pick one or more of them instead of scanning everything, and shows you exactly how the scan will be scoped before you launch it.
Areas are recognized across scans, so an area keeps its identity as the code around it moves. Areas your repository still has are listed with their size, areas from earlier scans stay selectable, and areas that have merged or disappeared are handled for you. The areas a scan was pointed at appear in your scan history, and each scan shows the scope its analysis actually settled on.
Areas now come out consistently, and their sizes are measured the same way the scan's own coverage is. A repository that used to end up with no areas at all gets them, two scans of the same code agree on where the boundaries fall, and the coverage a scan reports is measured against the code it actually set out to read.
When you scope a scan to part of a repository, the launch page also offers a budget matched to the size of what you picked. Automations can rotate through a set of areas, taking the least recently scanned one each time, so a large repository gets worked through steadily rather than sampled at random.
Every repository is analyzed when you add it
Adding a repository now starts a pass over it that costs you no credits. It produces the repository's audit areas, its threat model, and the questions worth answering first, so your first real scan already knows the shape of the codebase and can be pointed at the part that matters.
The repository page says it is being analyzed while this runs. When it finishes, we email you that the repository is ready for auditing, listing the areas an audit would work through, or telling you the repository is small enough to take in one go. The same list appears on your project dashboard and the repository page, and every area is one click from a scan scoped to it.
Repositories you have already scanned are unaffected: your existing scans produced the same picture, so nothing is redone.
Sniper: a new flow for the most severe bugs
ZKAO Max gains Sniper, a new analysis flow aimed at the code where a single mistake breaks the whole system. It goes after the bug classes that do the most damage there: values a malicious prover or party can swap for something else, checks that pass while the property they stand for is false, and secrets that stay exposed through a reveal even when the result looks correct.
Sniper runs alongside the flows ZKAO Max already had, so a scan reaches issues the broader passes can walk past, including in code earlier scans already looked at.
New coverage: Solana, Go, and protocol design
Scans now understand Solana on-chain programs, including Anchor, Pinocchio, and native programs, and the account confusions that only exist on Solana. Token-2022 is covered too, from transfer hooks and confidential transfers to the rounding and fee behavior that surprises programs written against classic SPL tokens.
Go codebases get their own treatment, aimed at the crypto bugs the Go toolchain does not catch: state shared across goroutines, values copied out from under a stateful object, and length arithmetic that is safe on one architecture and not on another.
Handshakes, key exchanges, and secure channels are now analyzed as designs, not just as code. A scan can take the properties a handshake claims, mutual authentication, transcript binding, forward secrecy, resistance to replay and reflection, and check symbolically whether the message flow really forces them.
ZKAO Max: techniques that rotate
ZKAO Max looks for bugs several different ways, and it now uses one of those techniques per scan and rotates to the next one after: Testator, Paper Cuts, Many Eyes, and Sniper each take a turn. A repeat scan therefore looks at the code in a way the last one did not, and a Max scan costs less than one that runs all four. Max now starts at 12,750 credits rather than 17,000.
The launch page names the technique your next scan will use before you launch it. You can add any of the others, or all of them, and each one shows what it adds to the minimum budget first. Adding all four is the Max scan exactly as it was, and starts at 17,000 credits, the floor that keeps Max's deepest analyses from stopping short on the large codebases it is built for.
Everything else Max runs is unchanged and runs on every scan.
Better analysis
Our Overview and Calibration flows have improved. They give each scan a sharper picture of the code it is auditing, so scans surface more real issues, including in code earlier scans already looked at. Overview also gets more time on large repositories, so its picture holds up on codebases that used to outgrow it.
SnarkSentinel, Cryptopsy, Gestalt, Testator, Invariants Hunter, and Paper Cuts now put their budget where the analysis actually goes. Lines of investigation that used to stop short now run to a conclusion, so these flows finish more of what they start and report more of what they find. Cryptopsy is also better at judging a design against the way the rest of the field builds the same thing.
Many Eyes is sharper on the claims that decide whether a bug is real. Testator carries what it learned into the next scan of the same repository, and keeps testing to the end of its budget. Free Agent holds on to its leads between scans instead of starting cold.
Calibration also gets more out of the questions you answer. An answer that settles several things at once now becomes a separate line of guidance for each one, instead of being condensed into a single line that kept only part of what you said. Suggested guidance arrives as short list items, so you can see at a glance what each one commits you to. Questions are now asked one at a time, so a long list is no longer a wall of text.
A launch page in three steps
Starting a scan is now three steps: the repository and commit, then guidance and scope, then the scan type and budget. Each step collapses to a one-line summary once you have been through it, the sidebar keeps a running summary of your choices, and you can jump back to any step from it.
The budget step now makes a single recommendation, drawn from what your past scans of that repository actually spent rather than from a flat preset floor. Budget warnings sit outside the card and apply themselves in one click, and the warning about running under your last scan's budget is repeated next to the Launch button, where the decision is actually made.
You can also turn a scan into a standing one as you launch it. Tick "Keep running this scan" to have the same repository, scan type, and budget run again on a schedule or on every new zkao release. Automations now have their own pages for editing later, and their budget is prefilled from what one run actually covers.
Invoices for every credit purchase
Credit purchases now produce an invoice. Open the Invoices section on your project's Plan and billing page to view one, print it, or save it as a PDF for your records.
Card purchases are recorded as paid the moment the payment goes through. Invoices issued for payment by wire or crypto are marked paid once the funds arrive. Refunds are shown on the invoice they belong to, and billing activity is now a dense table with a link to each one.
Other Changes
- Guidance you write for a single scan no longer disappears quietly. The launch page tells you when a scan is about to run with less guidance than your last scan on that repository, shows you the difference line by line, and can restore what the previous run used.
- The guidance editor can now save what you typed as the repository's standing guidance in the same step, so later scans start from it.
- Findings read more directly. Each one states plainly what an attacker gains, explains itself in short steps, and points at a single repository path that is the same everywhere the finding appears.
- A scan that finishes now publishes findings that were still being processed, instead of leaving them out of the report.
- Connecting your GitHub account now tells you what happened, including when your organization still has to approve the install.
- Scans in flight show a progress bar on the project dashboard.
- The sidebar collapses to an icon rail instead of vanishing, and phone visitors are offered a home-screen shortcut.
- Adding context documents shows all three ways to add one at once, and large uploads no longer fail on an error page.
- A repository you never scanned is deleted immediately instead of waiting out the grace period that protects scan history.
- The last credit in your balance is now spendable.
- The public API reports whether a repository has been analyzed and is ready to scan, and API token management no longer depends on your credit balance.