# Features Each section says what a feature does, when to use it, and who can use it. The steps are in [Common flows](/docs/flows). The app calls one security review an **audit**. The CLI also calls it a **Job**. ## Workspaces and roles ### Workspaces A workspace holds your audits, people, credits and GitHub connections. Use one workspace per team or client. Use the workspace menu at the top of the app to switch workspaces. **Shared with me** in the account menu lists audits that other workspaces shared with you. How to: [Create a workspace](/docs/flows/workspaces). ### Roles Each person has one role in each workspace. | Role | Can | | --- | --- | | Viewer | Read audits, findings and comments. Check prices. Invite Viewers. | | Member | Viewer access, plus start, cancel, resume and fork audits. Comment, set finding statuses and share audits. | | Admin | Member access, plus manage people, settings, credits, funded workspaces and GitHub. | You can invite people at your own role or below. A workspace always keeps at least one Admin. How to: [Invite people and change roles](/docs/flows/members). ### Funded workspaces A funded workspace spends the credits of the workspace that created it, its funding workspace. Each funded workspace has **Authorized credits**: the total credits that it can use. The total cannot go below the credits already used. Every Admin of the funding workspace is also an Admin of each funded workspace. The funding workspace still runs its own audits. The app also calls a funded workspace a team. Use a funded workspace to give a team or client its own audits and people, paid from your credits. A funded workspace cannot fund another workspace. An existing workspace cannot become funded. When an Admin archives the funding workspace, each funded workspace continues as an independent workspace with 0 credits. How to: [Create a funded workspace](/docs/flows/funded-workspaces). ### Archive a workspace **Archive workspace** in **Settings → General** stops new audits, invitations and settings changes. Past audits stay readable. Admins can still change roles and remove people. An Admin cannot archive a funding workspace while one of its funded workspaces has a queued or running audit. ## Audits ### Audit types | Type | Use it to | | --- | --- | | **Full audit** | Audit every file in scope. | | **Diff review** | Review the changes between a base commit and a new commit. | | **Fix review** | Check whether the fixes for an earlier audit's findings work. | Choose **Agile** or **Deep** under **Audit mode** at the top of **New audit**. A full audit defaults to Deep. Diff reviews and fix reviews default to Agile. Complete is available only to Zero Cool staff. In the CLI, use `zerocool config edit --mode agile` or `zerocool config edit --mode deep`. Run `zerocool quote` to check the selected mode and price before starting. How to: [Start an audit](/docs/flows/start-audit). ### Audit options **New audit** is one page. Choose **Audit type** and **Audit mode** at the top. - **Audit type**: Full audit, Diff review or Fix review. - **Audit mode**: Agile or Deep. Full audits default to Deep. Diff reviews and fix reviews default to Agile. Complete is available only to Zero Cool staff. - **Scope**: use **Paste in scope** or the file tree, then select **Confirm source**. - **Audit name (optional)**: set a name or keep the default repository names. - **Price**: check the credits for the selected mode and scope. - **Credits**: leave it empty to use the suggested amount. More credits let the audit explore further. - **Advanced options → Proof of concept**: Required proves findings with tests. Skip leaves out the tests. - **Advanced options → Context files**: add specifications or earlier reports. A standalone fix review requires the earlier report. - **Advanced options → Targeted audit focus**: tell Zero Cool what matters most and what to leave out. - **Advanced options → Report format**: Zero Cool, Cantina, Sherlock, HackenProof, yAudit or Cyfrin. - **Advanced options → Audit with missing dependencies**: audit even when a dependency repository is unavailable. - **Advanced options → Knowledge carryover**: use earlier workspace audits. Acknowledged or Invalid issues stay out of the report. This option is on by default. Clear it for an independent audit. On a fork, clear it to use only the fork chain. Select **Review and start audit** to open **Confirm audit details**. Check the source, scope, mode and price, then select **Start audit**. ### Context files In **Audit options → Advanced options → Context files**, attach text documents, such as a specification or an earlier audit report. Give each document a title and a description, so Zero Cool knows how to use it. A fix review that does not start from an audit in Zero Cool needs the earlier report. ### Prices and credits Zero Cool suggests the credits for an audit from the lines of code in scope. For a full audit, let L be physical lines in scope, including comments and blank lines: | Mode | Suggested credits | Minimum credits | | --- | --- | --- | | **Deep audit** | 2.5 × L^0.8, rounded up | 500 | | **Agile audit** | 0.625 × L^0.8, rounded up | 250 | Agile uses one quarter of the Deep formula, with its own minimum. A review counts only the files that its commit range changed. Set **Credits** to spend more or less than the suggested amount. The price shows on the **Review** step of **New audit**. Checking a price creates nothing and costs nothing. **Create audit** reserves the price. A completed audit keeps the charge. A failed or cancelled audit keeps the charge only if it delivered a new finding. Otherwise Zero Cool returns the credits. Every audit comes with a fix review. How to: [Check the price](/docs/flows/quote) and [Add credits](/docs/flows/credits). ### Audit page The audit page shows the status and tabs for **Findings**, **Scope**, **Artifacts** and **Events**. **Events** is the audit's timeline. **Scope** lists the audited files. **Artifacts** holds supporting audit documents. **Details** in the header shows **Reserved credits** and **Charged credits**. | Status | Meaning | | --- | --- | | Queued | Accepted and waiting to start | | Running | In progress | | Interrupted | Stopped. Read the status message. A Member can **Resume** it when the app offers that action. | | Completed | Finished | | Failed | Ended with a failure | | Cancelled | Stopped on request | Members select the pencil beside the audit title to rename it when available. To stop an audit, select **More actions → Request cancellation**. Signed-in readers can add an audit to favorites with the star. How to: [Follow an audit and read findings](/docs/flows/follow-audit). ### Audit list **Audits** lists the workspace's audits. It groups each audit with its forks, such as fix reviews. Search by title, repository or branch. Filter by **Status**, **Created**, **Mine** and **Favorites**. ## Findings ### Findings and statuses Each finding gives its severity, affected code, impact, explanation and proof of concept. Findings can change while an audit runs. Your team records its response with **Status**: **Open**, **Acknowledged**, **Resolved** or **Invalid**. The status does not change Zero Cool's verdict. A fix review checks the fix. Members set statuses on the newest audit of a chain. ### Comments Members comment on a finding in its **Discussion** tab. Comments support Markdown and `@` mentions. Members also comment on a document in **Artifacts**, such as the threat model. A comment there corrects an assumption that the audit made. Comments cannot be edited or deleted. Comments and statuses open when an audit completes, fails or is cancelled. A later fork, such as a fix review, reads them. ### Sharing Members **Share** an audit in two ways: - **Invite people** gives a person with a Zero Cool account read-only access to this one audit. - **Public links** give anyone with the link a read-only view. A link can expire, and you can revoke it. Sharing does not add anyone to the workspace. How to: [Comment, share and export](/docs/flows/comment-share). ### Export **Export** gives **Copy report**, **Download report (.md)** and **Print or save as PDF**. **Copy finding** copies one finding as Markdown. ### Forks and fix reviews **Fork into new audit** starts a new audit from the newest completed audit of a chain. The fork reuses the earlier settings, documents and focus. Zero Cool merges a new focus with the earlier one. **Fix review** on the newest completed audit starts a fork that checks your fixes. Paste the fixed commit or its pull request. How to: [Verify your fixes](/docs/flows/fix-review). ### Known issues **Known issues** lists the issues that your team marked **Acknowledged** or **Invalid**, and issues imported as known. Later audits with **Knowledge carryover** leave these issues out of the report. How to: [Manage known issues](/docs/flows/known-issues). ### Notifications The bell shows notifications for the selected workspace. You get notifications when an audit completes, fails, is cancelled or reaches its spend limit. A pause or resume by a workspace user also sends a notification, unless the user is a platform administrator. Automatic interruptions, automatic restarts and staff pauses or resumes send no notification. Comments and mentions notify teammates who can read the finding. ## GitHub ### GitHub connection Connect the Zero Cool GitHub App to audit private repositories. Public repositories need no connection. Signing in with GitHub does not connect repositories. How to: [Connect GitHub](/docs/flows/github). ### Pull request reviews Zero Cool quotes a **Diff review** on pull requests. A person with the minimum GitHub role starts it from the quote comment on GitHub. Zero Cool posts the result on the pull request. **Block merges** sets a severity threshold: **Off**, **Critical**, **High+**, **Medium+** or **Low+**. The **Zero Cool review** check fails for an unaccepted finding at or above the selected severity. With **Off**, Zero Cool posts no check. Require the check in GitHub branch protection to block merges. Pull requests from forked repositories are not reviewed. How to: [Set up pull request reviews](/docs/flows/pr-reviews). ## Access and tools ### Sign-in and profile Sign in with email and password, **Sign in with GitHub** or **Sign in with Google**. A new email account starts with **Create account** and a verification email. **Forgot password?** resets a password. If you used the previous Zero Cool app, create an account with the same email, or sign in with Google or GitHub. In **Profile**, set your **Display name**. Teammates see it on comments, mentions and notifications. An account without a display name gets an **Add your name** prompt after sign-in. The account menu also switches between **Light mode** and **Dark mode**, and has **Sign out**. ### API keys An API key lets the CLI act for you, including scripts and coding agents that use it. Each key has a scope (one workspace or **All workspaces**), a role and an expiry. A key never exceeds your own access. How to: [Create an API key](/docs/flows/api-key). Details: [API keys](/docs/api-keys). ### CLI The `zerocool` CLI configures, prices and starts audits, follows them, and reads findings and comments. Admins also manage funded workspaces, invitations and members with it. Read the [CLI reference](/docs/reference/cli) and [Docs for coding agents](/docs/reference/agents). ### Help and feedback **Help and feedback** in the account menu searches the docs and sends **Feedback** or a **Bug report** to Zero Cool. **Docs** in the account menu opens these docs.