Each section says what a feature does, when to use it, and who can use it. The steps are in Common flows.
The app calls one security review an audit. The CLI also calls it a Job.
Workspaces and roles
Workspaces
A workspace holds your audits, people, credits and GitHub connections. Use one workspace per team or client. Use the workspace menu at the top of the app to switch workspaces. Shared with me in the account menu lists audits that other workspaces shared with you. How to: Create a workspace.
Roles
Each person has one role in each workspace.
| Role | Can |
|---|---|
| Viewer | Read audits, findings and comments. Check prices. Invite Viewers. |
| Member | Viewer access, plus start, cancel, resume and fork audits. Comment, set finding statuses and share audits. |
| Admin | Member access, plus manage people, settings, credits, funded workspaces and GitHub. |
You can invite people at your own role or below. A workspace always keeps at least one Admin. How to: Invite people and change roles.
Funded workspaces
A funded workspace spends the credits of the workspace that created it, its funding workspace. Each funded workspace has Authorized credits: the total credits that it can use. The total cannot go below the credits already used. Every Admin of the funding workspace is also an Admin of each funded workspace. The funding workspace still runs its own audits. The app also calls a funded workspace a team.
Use a funded workspace to give a team or client its own audits and people, paid from your credits. A funded workspace cannot fund another workspace. An existing workspace cannot become funded. When an Admin archives the funding workspace, each funded workspace continues as an independent workspace with 0 credits. How to: Create a funded workspace.
Archive a workspace
Archive workspace in Settings → General stops new audits, invitations and settings changes. Past audits stay readable. Admins can still change roles and remove people. An Admin cannot archive a funding workspace while one of its funded workspaces has a queued or running audit.
Audits
Audit types
| Type | Use it to |
|---|---|
| Full audit | Audit every file in scope. |
| Diff review | Review the changes between a base commit and a new commit. |
| Fix review | Check whether the fixes for an earlier audit's findings work. |
Choose Agile or Deep under Audit mode at the top of New audit. A full audit defaults to Deep. Diff reviews and fix reviews default to Agile. Complete is available only to Zero Cool staff.
In the CLI, use zerocool config edit --mode agile or zerocool config edit --mode deep.
Run zerocool quote to check the selected mode and price before starting.
How to: Start an audit.
Audit options
New audit is one page. Choose Audit type and Audit mode at the top.
- Audit type: Full audit, Diff review or Fix review.
- Audit mode: Agile or Deep. Full audits default to Deep. Diff reviews and fix reviews default to Agile. Complete is available only to Zero Cool staff.
- Scope: use Paste in scope or the file tree, then select Confirm source.
- Audit name (optional): set a name or keep the default repository names.
- Price: check the credits for the selected mode and scope.
- Credits: leave it empty to use the suggested amount. More credits let the audit explore further.
- Advanced options → Proof of concept: Required proves findings with tests. Skip leaves out the tests.
- Advanced options → Context files: add specifications or earlier reports. A standalone fix review requires the earlier report.
- Advanced options → Targeted audit focus: tell Zero Cool what matters most and what to leave out.
- Advanced options → Report format: Zero Cool, Cantina, Sherlock, HackenProof, yAudit or Cyfrin.
- Advanced options → Audit with missing dependencies: audit even when a dependency repository is unavailable.
- Advanced options → Knowledge carryover: use earlier workspace audits. Acknowledged or Invalid issues stay out of the report. This option is on by default. Clear it for an independent audit. On a fork, clear it to use only the fork chain.
Select Review and start audit to open Confirm audit details. Check the source, scope, mode and price, then select Start audit.
Context files
In Audit options → Advanced options → Context files, attach text documents, such as a specification or an earlier audit report. Give each document a title and a description, so Zero Cool knows how to use it. A fix review that does not start from an audit in Zero Cool needs the earlier report.
Prices and credits
Zero Cool suggests the credits for an audit from the lines of code in scope. For a full audit, let L be physical lines in scope, including comments and blank lines:
| Mode | Suggested credits | Minimum credits |
|---|---|---|
| Deep audit | 2.5 × L^0.8, rounded up | 500 |
| Agile audit | 0.625 × L^0.8, rounded up | 250 |
Agile uses one quarter of the Deep formula, with its own minimum. A review counts only the files that its commit range changed. Set Credits to spend more or less than the suggested amount. The price shows on the Review step of New audit. Checking a price creates nothing and costs nothing.
Create audit reserves the price. A completed audit keeps the charge. A failed or cancelled audit keeps the charge only if it delivered a new finding. Otherwise Zero Cool returns the credits. Every audit comes with a fix review.
How to: Check the price and Add credits.
Audit page
The audit page shows the status and tabs for Findings, Scope, Artifacts and Events. Events is the audit's timeline. Scope lists the audited files. Artifacts holds supporting audit documents. Details in the header shows Reserved credits and Charged credits.
| Status | Meaning |
|---|---|
| Queued | Accepted and waiting to start |
| Running | In progress |
| Interrupted | Stopped. Read the status message. A Member can Resume it when the app offers that action. |
| Completed | Finished |
| Failed | Ended with a failure |
| Cancelled | Stopped on request |
Members select the pencil beside the audit title to rename it when available. To stop an audit, select More actions → Request cancellation. Signed-in readers can add an audit to favorites with the star. How to: Follow an audit and read findings.
Audit list
Audits lists the workspace's audits. It groups each audit with its forks, such as fix reviews. Search by title, repository or branch. Filter by Status, Created, Mine and Favorites.
Findings
Findings and statuses
Each finding gives its severity, affected code, impact, explanation and proof of concept. Findings can change while an audit runs.
Your team records its response with Status: Open, Acknowledged, Resolved or Invalid. The status does not change Zero Cool's verdict. A fix review checks the fix. Members set statuses on the newest audit of a chain.
Comments
Members comment on a finding in its Discussion tab. Comments support Markdown and @ mentions.
Members also comment on a document in Artifacts, such as the threat model.
A comment there corrects an assumption that the audit made.
Comments cannot be edited or deleted.
Comments and statuses open when an audit completes, fails or is cancelled. A later fork, such as a fix review, reads them.
Sharing
Members Share an audit in two ways:
- Invite people gives a person with a Zero Cool account read-only access to this one audit.
- Public links give anyone with the link a read-only view. A link can expire, and you can revoke it.
Sharing does not add anyone to the workspace. How to: Comment, share and export.
Export
Export gives Copy report, Download report (.md) and Print or save as PDF. Copy finding copies one finding as Markdown.
Forks and fix reviews
Fork into new audit starts a new audit from the newest completed audit of a chain. The fork reuses the earlier settings, documents and focus. Zero Cool merges a new focus with the earlier one. Fix review on the newest completed audit starts a fork that checks your fixes. Paste the fixed commit or its pull request. How to: Verify your fixes.
Known issues
Known issues lists the issues that your team marked Acknowledged or Invalid, and issues imported as known. Later audits with Knowledge carryover leave these issues out of the report. How to: Manage known issues.
Notifications
The bell shows notifications for the selected workspace. You get notifications when an audit completes, fails, is cancelled or reaches its spend limit. A pause or resume by a workspace user also sends a notification, unless the user is a platform administrator. Automatic interruptions, automatic restarts and staff pauses or resumes send no notification. Comments and mentions notify teammates who can read the finding.
GitHub
GitHub connection
Connect the Zero Cool GitHub App to audit private repositories. Public repositories need no connection. Signing in with GitHub does not connect repositories. How to: Connect GitHub.
Pull request reviews
Zero Cool quotes a Diff review on pull requests. A person with the minimum GitHub role starts it from the quote comment on GitHub. Zero Cool posts the result on the pull request. Block merges sets a severity threshold: Off, Critical, High+, Medium+ or Low+. The Zero Cool review check fails for an unaccepted finding at or above the selected severity. With Off, Zero Cool posts no check. Require the check in GitHub branch protection to block merges. Pull requests from forked repositories are not reviewed. How to: Set up pull request reviews.
Access and tools
Sign-in and profile
Sign in with email and password, Sign in with GitHub or Sign in with Google. A new email account starts with Create account and a verification email. Forgot password? resets a password. If you used the previous Zero Cool app, create an account with the same email, or sign in with Google or GitHub. In Profile, set your Display name. Teammates see it on comments, mentions and notifications. An account without a display name gets an Add your name prompt after sign-in. The account menu also switches between Light mode and Dark mode, and has Sign out.
API keys
An API key lets the CLI act for you, including scripts and coding agents that use it. Each key has a scope (one workspace or All workspaces), a role and an expiry. A key never exceeds your own access. How to: Create an API key. Details: API keys.
CLI
The zerocool CLI configures, prices and starts audits, follows them, and reads findings and comments.
Admins also manage funded workspaces, invitations and members with it.
Read the CLI reference and Docs for coding agents.
Help and feedback
Help and feedback in the account menu searches the docs and sends Feedback or a Bug report to Zero Cool. Docs in the account menu opens these docs.