# ZeroPath

> ZeroPath is an AI-native application security platform that automatically finds and fixes software vulnerabilities. Founded in 2024 by four security and engineering veterans - including a former Google Security Engineer and a former Tesla Red Team engineer - ZeroPath replaces noisy legacy SAST tools with an LLM-powered engine that understands code semantics, verifies exploitability, and generates working patches. Within a year of launch, over 1,000 organizations trust ZeroPath to scan more than 200,000 codebases per month.

- **Founded:** 2024
- **Headquarters:** San Francisco, CA, USA
- **Founders:** Dean Valentine (CEO), Etienne Lunetta (COO), Raphael Karger (CTO), Nathan Hrncirik (CIO)
- **Team size:** Small startup team; exact headcount not publicly disclosed
- **Products:** AI-Native SAST, Software Composition Analysis (SCA), Infrastructure as Code (IaC) Security, Secrets Detection, Automated Patch Generation
- **Notable:** Named Top 10 Finalist in RSAC 2026 Innovation Sandbox - cybersecurity's premier startup competition (March 2026), Discovered and reported 170 verified bugs in the curl project (HTTP/3, SMTP, IMAP, TFTP, Telnet, SSH/SFTP), covered by The Register (October 2025), Discovered CVE-2025-29927 (Next.js Middleware Authorization Bypass) and CVE-2025-49826 (Next.js Cache Poisoning)

## Products & services

- **AI-Native SAST** — LLM-powered static application security testing that uses Abstract Syntax Tree analysis to understand full codebase context, finding 2x more real vulnerabilities with 75% fewer false positives than traditional tools. Supports 16+ programming languages.
- **Software Composition Analysis (SCA)** — Supply chain and open-source dependency vulnerability detection.
- **Infrastructure as Code (IaC) Security** — Cloud infrastructure security scanning for misconfigurations and risks in IaC templates.
- **Secrets Detection** — Automated scanning for exposed credentials, API keys, and secrets embedded in code.
- **Automated Patch Generation** — Generates working pull request patches for discovered vulnerabilities, cutting remediation time by approximately 90%.
- **Secure AI-Generated Code** — Purpose-built solution for securing vibe-coded and AI-generated codebases.
- **MSSP Solutions** — Managed security service provider offering for security consultancies and managed service providers.
- **MCP Server (Open Source)** — Open-source Model Context Protocol server that lets AI assistants like Claude, Cursor, and Windsurf query ZeroPath security issues, patches, and scans directly.

## Achievements

- Named Top 10 Finalist in RSAC 2026 Innovation Sandbox - cybersecurity's premier startup competition (March 2026)
- Discovered and reported 170 verified bugs in the curl project (HTTP/3, SMTP, IMAP, TFTP, Telnet, SSH/SFTP), covered by The Register (October 2025)
- Discovered CVE-2025-29927 (Next.js Middleware Authorization Bypass) and CVE-2025-49826 (Next.js Cache Poisoning)
- Filed 36 sudo bug fixes, including a previously unpublished RCE targeting sudo's optional log server
- Discovered CVE-2026-32604 and CVE-2026-32613 - two RCE vulnerabilities in Spinnaker
- Grew to 1,000+ organizations and 200,000+ code scans/month within roughly one year of public launch
- 3x ARR growth reported in March 2026
- Y Combinator Summer 2024 (S24) batch
- Helped Aptos Labs accelerate vulnerability discovery 8x across 1M+ lines of Rust code

## Latest updates

- **2026-03** — Named Top 10 Finalist at RSAC 2026 Innovation Sandbox; presented March 23 at RSA Conference in San Francisco
- **2026-03** — Announced 3x ARR growth, 1,000+ organizations, and 200,000+ monthly code scans via BusinessWire press release
- **2026-04** — Published blog post 'On Recent AI Model Progress' reflecting on AI developments and security implications
- **2026-03** — Discovered CVE-2026-32604 and CVE-2026-32613 - two RCE vulnerabilities in Spinnaker
- **2025-10** — ZeroPath's 170 valid curl bug reports covered by The Register, winning over the curl maintainer community
- **2025-01** — Public platform launch and $7M seed round announced

## Links

- Website: https://zeropath.com
- LinkedIn: https://www.linkedin.com/company/zeropathai
- Twitter/X: https://x.com/zeropathAI
- GitHub: https://github.com/ZeroPathAI

---

Profile page: https://yespress.io/zeropath
Published by YesPress — https://yespress.io
Last updated: 2026-04-27