Why it mattersSecurity tools that stop at a finding leave the hardest work with a human. A tool that writes the pull request changes who holds the backlog.
0.security launched on Y Combinator today with eight votes on the launch page. The company says it builds AI agents that go past finding a vulnerability. The agents also write the patch and prove the fix works. The pitch on the launch page is one line: "Software already writes itself. We make it secure itself."
What the product does
0.security's own page lists five capabilities. It scans pull requests with AI agents and offers one-click fixes. It tracks newly disclosed vulnerabilities and matches them against a codebase. It writes fixes for the issues it finds. It runs software composition analysis on dependencies. It runs continuous pen-testing with agents that look for both known CVEs and zero-day issues.
The company frames its difference from older tools in one line. "Finding vulnerabilities isn't the bottleneck anymore. The work is: investigating each risk for business impact, writing the patch and proving the fix works." That is 0.security's own framing.
The founders
The YC launch page names two founders. Fabian Zbinden co-founded Mellivora Capital, which the page describes as a regulated quant fund. He was also an early hire at Crypto Finance, by the page's account. Doruk was previously Chief Engineer for Cyber & Autonomous Systems on Switzerland's Mars Rover team, by the page's account. He also worked in cyber defence. The page gives no last name for Doruk.
The track record claim
0.security says on YC that it has found and fixed more than 30 Linux kernel zero-days. It says the team has also fixed more than 500 CVEs. It says these include previously unknown bugs in government software in more than one country. The page says the team has worked with engineers from Google, NVIDIA, Red Hat and Intel on these fixes. Those are 0.security's own figures. We did not check any of them with the Linux Foundation, the named companies or the CVE registry.
Named customers
The YC page names two customers: EY and the Swiss Federal Department of Defence. The 0.security site also lists a Spotify senior engineer testimonial and a Nordfen founding engineer testimonial. The site claims the platform has produced fixes used by AMD, Qualcomm, Cisco, Google, Meta, Intel and Nvidia. Those are 0.security's own claims. We did not reach any of these companies to confirm.
The offer
0.security is offering 100 dollars in free credits, which it says covers 50 pull requests. Developers connect a repository through its cloud platform to use the credit.
What this signals
A security tool that stops at a finding leaves the hard part with a human. The human still has to understand the risk, write the patch and show the fix works. 0.security is one of several AI security startups pitching that the agent should own that last part too. The claim is testable: a team can connect a real repository and spend the free 50 pull requests. The team then sees what the agent does on its own code.
The company does not disclose the funding behind the launch. It says it is part of AWS Startups, Microsoft for Startups and security programs at Anthropic, OpenAI and Microsoft. Those memberships are self-disclosed. A team that wants to try it should treat every number on the launch page as the company's own account. Wait for a third party test before reading them as proof.
Source
- 0.security: The autonomous cybersecurity team that ships fixes, not findings, Y Combinator Launches
- 0.security product page, 0.security
This item was written by an AI system from the linked source. Reveneau is responsible for what it publishes.
Get AI News in your inbox
New developer tools, model and agent releases, and how teams are actually using them to release software. Short, and only when there is something worth reading.
