See what ZeroU did to your demo — in 30 seconds.
ZeroU scans your vibe-coded demo, patches it, verifies the patch ran, and leaves a grep-able audit trail. Built for shipping, not for screenshots.
Under a minute, end-to-end.
From a vibe demo to a verified, traceable, hardened app — with bench receipts at the end.
Vibe-coded demo. Works locally.
Pre-production. 31 hardening gaps. Zero structured logs. No tests.
Stage 1 of 7 — Problem: vibe-coded demo, ~31 hardening gaps
The whole pipeline — not a single trick.
Preset-driven static + LLM scan finds the bug classes you actually care about — secrets, SQLi, missing auth, weak crypto. Tunable. Auditable. No vibes.
Each finding becomes a targeted patch on its own branch. claude-cli does the typing; ZeroU constrains scope so the patch fixes the bug — not the surrounding 200 lines.
Generated tests cover the patched path. Critic verdict (confirmed / false-positive / needs-context) per finding. Branch-coverage check ensures the fix actually ran.
Every step writes a line of structured JSONL. Six months from now you can grep `branch_id`, replay the verdict, and show your auditor the receipts.
What ZeroU produced on a real demo.
We ran zerou enhance on meme-weather — a real Next.js + Drizzle + Supabase demo. Output below is the actual diff merged into the project.
- src/logger.ts+61 LOC (NEW)
- middleware.ts+30 LOC (NEW)
- instrumentation.ts+8 LOC (NEW)
- sentry.{client,server,edge}.config.ts+18 LOC (NEW)
- app/health/route.ts+14 LOC (NEW)
- .env.example+3 LOC
- lib/db/client.ts+2 -1
- lib/db/seed.ts+9 -8
- 119 console.log → logger.info5 files
- pino logger bootstrap — src/logger.ts (AsyncLocalStorage correlation, redact rules)
- /health endpoint — app/health/route.ts
- Sentry SDK — @sentry/nextjs@^8.50.0 + 3 configs + instrumentation.ts
- middleware.ts — x-correlation-id in/out, request.start / request.end events
- .env.example — LOG_LEVEL added (7 vars already declared, untouched)
- 119 console.log → logger sites across 5 files
- Decision-event JSONL log under .zerou/logs/ — replayable audit trail
- Verify gate PASS — install · tsc · test
Branch zerou-enhance-20260528-131520 — review the diff, merge or drop. ZeroU never auto-merges to your main.
.zerou/enhance-report.md. Reproduce: cd meme-weather-zerou-test && npx zerou enhance.Watch every fix in flight
ZeroU runs as a local daemon with a web dashboard at localhost:5173. Mission Control over project → session → workspace → commit, with live fix progress.
Open the Mission Control dashboard
ZeroU runs a local web dashboard at localhost:5173. When the owner's daemon is up and tunnelled, you can drive it from any device.
# On owner's machine zerou start # daemon at :5174, UI at :5173 cloudflared tunnel --url http://localhost:5173 # Set on Vercel NEXT_PUBLIC_DASHBOARD_URL=https://<random>.trycloudflare.com
The link below is Loeser's laptop.
The meme-weather demo we just hardened is tunnelled out from a MacBook on the owner's desk. If you can reach it, the tunnel is up. If not, the laptop is asleep or the cloudflared process died — that's also a real signal about hobby-project ops.
cloudflared tunnel --url http://localhost:3000 # → https://<random>.trycloudflare.com # paste that into Vercel env: NEXT_PUBLIC_LIVE_DEMO_URL # redeploy. button goes live until cloudflared dies.
从官网直达我本机起的服务（内网其它电脑可看）
演示动画托管在本站,任何人可直接看。下面的「本机服务」按钮跳到你这台机起的各项目服务——同内网的电脑打开本官网、点一下即可直达。
HOST=0.0.0.0 npm start;python: python server.py --host 0.0.0.0）,并放行端口的防火墙入站。 IP 是 DHCP 会变,变了在上面框里改一下即可（自动记住）。若浏览器拦截 http 链接,允许一次即可。Log as proof.
You don't get a confidence score. You get one independently grep-able line per decision the agent made — six months from now still readable, still replayable.
Every scan, every fix attempt, every critic verdict lands in .zerou/branch-trace.jsonl. No DB to query. No SaaS to sign up for. Just a file your auditor already knows how to read.
# count unique branches your audit explored
$ cat .zerou/branch-trace.jsonl \
| jq -r '.branch_id' | sort -u | wc -l
47
# show every decision the critic made on this finding
$jq 'select(.finding_id == "sql-001")' \
.zerou/branch-trace.jsonl
{ "step": "detect", "verdict": "hit", ... }
{ "step": "patch", "branch": "fix/sql-001", ... }
{ "step": "verify", "result": "confirmed", ... }Bench numbers, no spin.
Phase 22 run of hardener-bench. ZeroU (MiniMax critic) vs raw Claude Sonnet 4.6 / Opus 4.7 via the CC subscription. Proximity scoring (file + line ± tolerance), uniform across tools. Methodology and reproducer in the comparison report.
| bench | truths | ZeroU | Sonnet 4.6 | Opus 4.7 | winner |
|---|---|---|---|---|---|
zerou-target Preset-aligned vulns: secrets / SQLi / missing-auth / weak-crypto. ZeroU is 2.2× more precise at equal recall. | 19 | P=0.91 · R=1.00 | P=0.46 · R=0.90 | P=0.41 · R=0.95 | ZeroU |
juice-shop-mini OWASP Juice Shop (681 files). Sonnet's fair 200-file cap missed every truth file. ZeroU scans the whole repo for ~$0.20. | 20 | R=0.75 | R=0.00 | (too slow to finish in cap) | ZeroU |
bugsjs-mini Pure logic bugs (off-by-one, missing await). Honest loss: no preset covers this class yet — roadmap item. | 50 | 0 / 50 | 6 / 50 | 11 / 50 | Opus |
cost / audit ZeroU's cost scales with finding count (MiniMax critic). Raw Claude scales with codebase size. | — | $0.05 – $0.20 | $0.50 – $1.50 | $2.00 – $8.00 | ZeroU |
Four commands. Your demo is hardened.
ZeroU runs locally and drives the Claude Code CLI as its worker. No API key. No SaaS dashboard. Your code never leaves the machine.
$ zerou audit ./my-app$ zerou enhance ./my-app$ zerou review ./my-app --serve$ zerou coverage ./my-app --threshold 50$ npm install -g zerou
$ zerou --version
zerou 0.1.0 · alpha · MIT