AutoZero – Automated Zero-Day Exploit Discovery Framework for Web Applications

AutoZero is an automated framework to discover and triage zero-day web application vulnerabilities. It combines fast, context aware static analysis (static application security testing/SAST) with an asynchronous queue/worker model to scale with the ecosystem, and an extensible vulnerability engine that reports on the typical web flaws (SQLi, XSS, CSRF, hardcoded secrets, insecure DOM usages, missing security headers, etc.). In addition, AutoZero includes a modern-full stack of a Next. js 14 + React 18 front-end; NestJS back-end; PostgreSQL + Drizzle ORM; Redis + BullMQ queue; Docker + Render deployment, and is designed to have quick turnaround (a typical static scan takes 5 – 10 minutes run time), very low filtering of false positives (reporting ~5% of reports), and an integrated ownership/reporting/usage/dash-boarding approach that can multi-tenanted. This paper will provide details on the system design, implementation detail, evaluated against it's benchmarks and prior art, and future extensions (DAST, CI/CD, and LLM assisted). These implementation details and metrics are from literature summarizing both the project specification and supporting literature.