Find the flaw. Engineer the fix. Prove it with evidence.
An AI-assisted security engineering platform combining code analysis, intelligent investigation, autonomous remediation and evidence-oriented verification.
Explore the Code · How It Works · Core Capabilities · Getting Started
Finding a vulnerability is one thing. Understanding it, engineering a meaningful fix and verifying the result is another.
ZeroDay is built around that entire journey.
It brings AI-assisted code analysis, intelligent investigation, remediation and controlled verification into one security engineering workflow; helping developers move from a suspicious code path toward an actionable, evidence-backed result.
The core idea: Don't stop at finding the flaw. Work toward proving the fix.
- Code-aware security analysis — inspect code and identify potentially vulnerable paths
- AI-assisted investigation — use an AI-driven workflow to help reason about findings
- Automated remediation — generate candidate fixes for identified issues
- Controlled validation — execute supported checks in a controlled environment
- Verification-first workflow — evaluate remediation using verification gates and supporting evidence
- Developer-focused interface — bring the security workflow into a unified web experience
Track: Coding & Agentic Engineering
AI can help developers write code, but generating a patch is not the same as proving that it works. Security analysis, root-cause investigation, remediation and verification are often disconnected steps. A proposed fix can pass basic tests while leaving the underlying vulnerability unresolved.
ZeroDay turns vulnerability discovery into a verification-oriented security workflow.
Instead of stopping at a suspicious code path or an AI-generated patch, ZeroDay coordinates a sequence of specialized stages:
- Target Repository: Analyze the target codebase to identify potentially vulnerable code paths
- Tavily Threat Research: Look up relevant security advisories and vulnerability guidance, with an offline fallback
- Red Team Agent: Run exploit tests against the target application to check whether the suspected vulnerability is reproducible
- Nemotron Security Analysis: Investigate the vulnerability's root cause and determine a suitable remediation approach using NVIDIA Nemotron via Nebius Token Factory
- Blue Team Agent: Generate and apply a security fix targeting the identified vulnerability
- Sandbox Rematch & Verification: Rerun tests and replay exploit attempts to check whether the fix works
- Verified Results (Pass): Record the outcome when the required verification checks pass
- Rollback to Baseline (Fail): Restore the saved baseline if verification fails
| Layer | Technology |
|---|---|
| Frontend | React, Vite, JavaScript |
| Backend | Python, FastAPI |
| AI model | NVIDIA Nemotron |
| Inference infrastructure | Nebius Token Factory |
| Execution and isolation | Docker-based workflows |
| Testing | Pytest |
- Python
- Node.js and npm
- Docker Desktop, if required by the execution workflow
- A configured Nebius API key for live model inference
git clone https://github.com/darshansahare/ZeroDay.git
cd ZeroDayCreate your local environment configuration using .env.example as the reference.
Add your own API credentials locally. Never commit your .env file or private API keys.
Follow the backend and frontend dependency instructions in the repository. Exact commands may depend on the current project configuration.
Use the run commands documented for the current backend and frontend setup. If using the production-served frontend, ensure the required frontend build assets are available.
- Expand supported vulnerability patterns and code-analysis coverage
- Improve remediation quality and verification reliability
- Strengthen test coverage and reproducibility
- Improve reporting and evidence presentation
- Extend support for additional languages and project types
Contributions, bug reports and suggestions are welcome. Open an issue to discuss a proposed change before submitting a pull request.
Released under the MIT License.