Security work has to follow the code
A developer ships a change. A dependency changes underneath it. Somewhere else in the stack, a researcher finds a bug that needs reproducing and fixing.
0.security builds tools for that continuing work. Its AI security harness investigates code, organizes findings and works on fixes, with evidence an engineer can review. [1]
The Swiss applied AI research lab is working toward software that secures itself: discovery, verification and remediation connected in one process. [1]
An open harness for the investigation
The open-source harness runs locally with a browser interface. Security teams can review source evidence, organize findings and track proposed fixes. [1]
The interface keeps notes and results in one place so engineers can pick up a review across sessions. The harness is a research preview. [1]
A managed service around the repository
0.security also works with enterprise teams on repository security, including pull request reviews and dependency checks. The team agrees with each customer on testing scope, reporting and deployment before work begins. [3]
Engineers decide which changes to apply. The enterprise offering lets them set where evidence is kept and which model providers can process it. [3]
Research that reaches an upstream fix
0.security publishes research across operating systems and application libraries. The lab reports that more than 30 Linux kernel security fixes have been merged upstream. [2]
That research informs the product’s focus on documenting a finding, proposing a fix and giving maintainers enough context to review it. [1][2]
Built between Zurich and San Francisco
Doruk Tan Öztürk and Fabian Zbinden founded 0.security around applied AI and cybersecurity research. The team is rooted in Zurich and works with the AI ecosystem in San Francisco. [1][4]
The company joined Y Combinator’s Fall 2026 batch. Its tools serve developers and security researchers, with enterprise options for organisations operating critical systems. [3][4]
Developers can explore the open-source harness. Teams that want a scoped security engagement can discuss their requirements with the company. [1][3]
The team wants security reviews to happen where software is built, while engineers can still act on the findings. [1][2]
Where 0.security ranks
A ranked comparison is not yet available for 0.security.
The bigger picture
The useful end of a security investigation is a fix that survives review and a clear account of why it works. [1][2]
0.security is building the tools and research behind that process, toward software that can help secure itself. [1][2]
Written by SOTA2 from 0.security’s public materials and information its founders provided. Customer experiences and product plans are reported by 0.security.