ZeroHour

Decision layer on top of SAST

ZeroHour answers one question:
What breaks the business first if this code fails?

CLI Semgrep AI-assisted Top 10 Prioritization SDK-ready

Why ZeroHour

Static analysis tools generate hundreds of findings with no prioritization. Teams know what is wrong, but not what to fix first.

How It Works

  1. Runs Semgrep to extract structured findings
  2. Normalizes findings into a unified dataset
  3. Uses Grok to reason about impact and priority
  4. Enforces Top 10 forced prioritization
  5. Optionally generates AI-assisted fix suggestions

Installation

npm install
npm run build

Usage

./zerohour analyze
./zerohour analyze -C path/to/project
./zerohour analyze --no-box

CLI and SDK

ZeroHour is available as:

Documentation

Status

Prototype built during a hackathon. Focused on decision clarity, not scanning completeness.