Freedom251 › Container Image Scanning Tools
ZeroPath
What ZeroPath is
ZeroPath is an AI-native application security platform for finding and fixing exploitable vulnerabilities across code, cloud, and runtime. Its stack includes SAST, SCA, secrets scanning, infrastructure-as-code scanning, pull-request reviews, policy management, DAST, container scanning, AI inventory, and AI-BOM generation. SAST targets business-logic and authentication flaws such as IDOR vulnerabilities, race conditions, and authorization bypasses. ZeroPath says SAST and SCA assess whether vulnerable dependencies are reachable and exploitable. The SAST service lists support for more than 15 languages, with average pull-request scans under 60 seconds. Native source-control integrations include GitHub, GitLab, Bitbucket, and Azure DevOps; Gerrit and CVS are also listed. Jira and Linear offer two-way issue synchronization, while Slack and email receive alerts. On-premises deployment can run in a customer’s AWS, Azure, or GCP account. The Team plan starts at $1,000 a month plus 60 USD per developer, and no free plan is available.
Who it suits
ZeroPath suits engineering teams shipping software that need source analysis, dependency reachability checks, pull-request reviews, and automated fixes. Enterprise customers can use self-hosted or private-cloud deployment options.
What it does well
- Covers code, cloud, and runtime security
- Supports 15+ programming languages
- Pull-request scans average under 60 seconds
- Offers automated fixes and PR reviews
- Provides CI/CD integration
What to know first
- No free plan
- Team starts at 1,000.00 USD monthly
- Team also charges 60 USD per developer
- Enterprise pricing is custom
Limits
There is no free plan. Team billing starts at $1,000 per month plus $60 per developer; Enterprise and Credits pricing is custom or usage-based.
Plans
| Plan | Billed and limits | Price |
|---|---|---|
| Team | Starting from $1,000/mo + $60/dev · Unlimited repositories & scans · SAST, SCA, secrets & IaC scanning · runtime validation · PR reviews & autofix · SSO/SAML · Jira, Linear & Slack | $1,000 a month |
| Enterprise | Custom · Everything in Team · on-prem/self-hosted/private cloud · BYOK · volume discounts · dedicated support & SLA · SCIM · policy engine · custom compliance reports | On request |
| Credits | Usage-based; Coming soon · Pay per scan · no monthly commitment · AI-native SAST, SCA & secrets scanning · PR reviews & autofix · CI/CD integration | On request |
As zeropath.com lists them, read 3 Oct 2026. The maker's own page has the final word.
Getting started
- Open the ZeroPath website
- Choose web, API, Linux, Windows, macOS, or self-hosted access
- Connect a supported source-control service
- Select Team, Enterprise, or usage-based Credits when available
- Configure pull-request, CI/CD, and workflow integrations
- Run scans against source code and review findings
Verdict
ZeroPath brings broad application-security scanning and workflow integrations into one platform. Its pricing is aimed at paid engineering and enterprise deployments, with self-hosted options for organizations requiring them.
Questions
How much does ZeroPath cost?
The pricing note says from $60 per user per month. The Team plan is listed at $1,000 USD per month plus $60 per developer; Enterprise pricing is custom, and Credits are usage-based.
Is there a free plan?
No. ZeroPath is listed as paid with no free plan.
Which platforms are supported?
Platforms listed are API, Linux, macOS, self-hosted, web, and Windows.
Which source-control services connect natively?
Native integrations include GitHub, GitLab, Bitbucket, Azure DevOps, Gerrit, and CVS.
Can ZeroPath run in a private environment?
Enterprise supports on-premises, self-hosted, and private-cloud deployment. On-premises operation can run in a customer's AWS, Azure, or GCP account.
Facts from ZeroPath's own pages
- AI data handling
- ZeroPath says its agreements with OpenAI and Anthropic prohibit training on customer data or retaining customer inputs beyond processing. · zeropath.com, 3 Oct 2026
- Code retention
- The Trust Center says source code is retained for 30 days for patch generation, Q&A, and rescanning, then automatically deleted. · zeropath.com, 3 Oct 2026
- Dependency analysis
- ZeroPath says its SAST and SCA assess whether vulnerable dependencies are reachable and exploitable in the application. · zeropath.com, 3 Oct 2026
- Deployment
- On-premises deployment can run in a customer's AWS, Azure, or GCP account, where the company says code never leaves the customer's environment. · zeropath.com, 3 Oct 2026
- Headquarters
- 2261 Market Street, STE 10797, San Francisco, CA 94114, United States · zeropath.com, 28 Sept 2026
- Intended users
- The pricing page positions Team for engineering teams shipping quickly and Enterprise for organizations with advanced needs. · zeropath.com, 3 Oct 2026
- Languages and speed
- The SAST page lists support for 15+ languages and says average pull request scans take under 60 seconds. · zeropath.com, 3 Oct 2026
- Purpose
- ZeroPath describes itself as an AI-native application security platform for finding and fixing exploitable vulnerabilities across code, cloud, and runtime. · zeropath.com, 3 Oct 2026
- SAST findings
- The SAST product targets business logic and authentication flaws, including IDOR vulnerabilities, race conditions, and authorization bypasses. · zeropath.com, 3 Oct 2026
- Security certification
- The Trust Center states that ZeroPath is SOC 2 Type II certified and GDPR compliant, and undergoes annual external penetration tests. · zeropath.com, 3 Oct 2026
- Security coverage
- Its product stack includes SAST, SCA, secrets scanning, IaC scanning, PR reviews, policy management, DAST, container scanning, AI inventory, and AI-BOM generation. · zeropath.com, 3 Oct 2026
- Source control integrations
- Native version control integrations include GitHub, GitLab, Bitbucket, and Azure DevOps, with Gerrit and CVS also listed on the site. · zeropath.com, 3 Oct 2026
- Support
- The Trust Center states a 24-hour response time for support requests and says priority support is available to enterprise customers. · zeropath.com, 3 Oct 2026
- Workflow integrations
- ZeroPath lists Jira and Linear two-way issue sync, Slack and email alerts, and imports from Snyk, Semgrep, Checkmarx, SonarQube, Veracode, Fortify, and Synopsys. · zeropath.com, 3 Oct 2026
Where ZeroPath stands on Freedom251
- Container Image Scanning Tools#23 of 29
- SAST Tools#22 of 26
- Software Composition Analysis Software#58 of 65