zerotrail

zerotrail brings offensive security into the development cycle, continuously testing applications and infrastructure with attacker intuition to prove what's actually exploitable.

Recently hardened: n8n, trigger.dev, lightdash, hatchet, anything-llm, mindsdb, entire.io, tiptap, cline, and more.

FIG.1
Your attack surface. Mostly noise or exposed to attackers.

Capabilities

Maps your applications & infrastructure.01 · ContextUnderstands your software across code, APIs, cloud, and infrastructure, giving zerotrail the context to reason through real attack paths.
Security that moves at the speed of your software.02 · CadenceContinuously tests code changes and deployments, bringing offensive security into the development cycle instead of waiting for the next pentest.
Thinks like an attacker.03 · IntelligenceUses offensive security methodology to reason through complex attack paths, connect seemingly unrelated vulnerabilities, and uncover the issues that actually matter.
Proves what's actually exploitable.04 · ProofValidates vulnerabilities before surfacing them, giving developers proof of real risk rather than another list of findings.

offsec/acc

maplibre/martinHigh · AUG 2026Out-of-gamut CIE color in the static-overlay body panics the renderer and permanently kills the render worker poolmaplibre/martinMedium · AUG 2026Unbounded id repetition in sprite, font, tiles amplifies server work for a byte-identical responseBudibase/budibaseHigh · AUG 2026Missing authorization on license management endpoints allows any authenticated user to delete licenselightdash/lightdashMedium · AUG 2026SSRF via unvalidated Google Chat and Microsoft Teams webhook URLs in scheduled deliveriestriggerdotdev/trigger.devHigh · JUL 2026Cross-tenant SQL injection in the TSQL query compiler (POST /api/v1/query) via unsanitized window-function name

All disclosures →

Use cases

Continuous Security Validation01Continuously tests your applications and infrastructure across code, deployments, and production, validating what's actually exploitable.
Pre-Production Testing02Point zerotrail at a branch, service, or environment for deeper offensive testing that connects attack paths and proves real exploitability.
Bug Bounty & Pentesting03Bug bounties are unpredictable and pentests go stale the moment you ship. zerotrail validates exploitability on demand, whenever you need it.

Book a meeting →

FIG.2SOURCESINKreq.bodyparse()buildQuery()db.raw()
A finding is a guess until the path is walked.