ZeroPath

What it does

ZeroPath is an application security platform for security teams and software engineering teams. It scans connected repositories and pull requests for code vulnerabilities, exposed secrets, dependency risks and infrastructure misconfigurations. Its SAST covers business-logic and authentication issues; dependency analysis considers reachability, while dynamic testing checks live applications for exploitable findings and verifies fixes. Findings appear in the dashboard and can be routed into development workflows; pull-request reviews provide inline comments, and the platform can generate AI-written patches.

Teams can connect repositories, enable pull-request scanning, and review findings, triage controls and suggested fixes. The service also offers a CLI for local or CI/CD scans, a VS Code extension, REST API, webhooks and an MCP server for AI coding assistants. Access includes a hosted dashboard; enterprise plans additionally list self-hosted and private-cloud deployment. The site offers a demo to discuss access. Published Team pricing starts at $1,000 per month plus $60 per developer, with unlimited repositories and scans; Enterprise is custom-priced. The pricing page also describes credit-based, usage-based pricing as coming soon.

ZeroPath’s scans and patch suggestions should be reviewed by maintainers before accepting changes; the documentation presents these as findings and generated fixes, not guaranteed outcomes. Team pricing combines a monthly base price and per-developer charge, while Enterprise requires a custom quote. Some listed capabilities, including on-demand code scans, are marked beta in the documentation.

What it can do

• AI-native static application security testing
• Reachability-aware dependency vulnerability analysis
• Secret detection and validation
• Infrastructure-as-code scanning
• Dynamic testing of live applications with exploit and fix verification
• Automated pull-request security reviews and AI-generated patches

Works with

• GitHub
• GitLab
• Bitbucket
• Azure DevOps
• Gerrit
• CVS
• Jira
• Linear
• Slack
• Wiz

Before you choose

• Generated fixes and scan findings need review; official descriptions do not establish guaranteed detection or remediation outcomes.
• Team pricing is a monthly base charge plus a per-developer charge; Enterprise pricing is custom.
• On-demand code scans are labeled Beta in the documentation; enterprise self-hosting and private-cloud options are listed under Enterprise.

Listed under

• Security
• App and code security
• Appsec
• Autofix
• Code security
• Devsecops
• Sast
• Sca

Get started

The site presents “Book a Demo” as the primary CTA.

1. Book a demo to discuss access and the deployment scope.
2. Connect a repository and run an initial scan.
3. Enable pull-request scanning and configure integrations or scanner settings as needed.

Team is described as an unlimited-scan subscription with a monthly starting price plus a per-developer charge. Enterprise is custom-priced and includes a free proof-of-value engagement. The page mentions credit-based pricing and usage-based pricing as coming soon; no numeric credit or usage rates are supplied. Independent security researchers may apply for free access; this is not an unrestricted recurring free plan. Confirm the cadence of the $60/developer charge and any seat minimum.

Source: zeropath.com/pricing, checked 1 Nov 2026. Prices can change; check before you buy.

Sources for this overview

Product pages, documentation, and pricing checked 1 Nov 2026. Each source supports part of the overview; availability and prices can change.

• ZeroPath - AI-Native SAST & AppSec Platform ↗zeropath.com
• Documentation - ZeroPath Documentation ↗zeropath.com
• ZeroPath Pricing - Team & Enterprise Plans | ZeroPath ↗zeropath.com

Company website

zeropath.com: product, pricing and policy pages

YC directory mirror

Batch and company name

Social accounts

Accounts the company links, and its posts on X

Human review

Checked by a person

manual_review

Last checked 1 Nov 2026. Every field keeps its source and date; unknown means we couldn’t confirm it.