# Introducing Ozone: AI Security That Never Stops Watching

> Source: <https://cecuro.ai/blog/introducing-ozone>
> Published: 2026-08-03 12:04:58+00:00

Introducing Ozone: AI Security That Never Stops Watching**TL;DR** - **Ozone is live today.** Connect a GitHub repository and an AI security engineer reviews every pull request the moment it opens: [ozone.cecuro.ai](https://ozone.cecuro.ai) - **It investigates, it doesn't skim.** Every review runs in an isolated sandbox where the agent reads files, traces call paths, and checks git history the way a human reviewer would - **High signal by design.** A finding must trace from an attacker-reachable entry point to concrete impact. A small, clean PR gets an empty findings list, not filler - **It learns your codebase.** A knowledge library of conventions and trust boundaries briefs every review, and nightly agents keep both the knowledge and your open findings current - **One engine, both worlds.** Smart contracts (Solidity, Rust, Vyper, Move) and the services around them (TypeScript, Python, Go, Java), because real exploits cross that boundary - **Free to start.** Sign in with GitHub, connect a repository, and your first $100 of reviews is included. No card required > Ozone runs on the same multi-agent engine as Cecuro's smart contract audits, ranked #1 on EVMBench. [Start free](https://ozone.cecuro.ai) and your first pull request review lands in minutes. ## Security review is a snapshot. Your codebase isn't. An audit covers your code as it existed on one day. It is a deep, valuable baseline, and we build our business on doing them well. But the moment the next pull request merges, the codebase and the report start drifting apart. Six months and four hundred merges later, the audit describes a system that no longer exists. The economics of that gap are getting worse, and not only in crypto. CVEs published per year grew 139% between 2021 and 2025 (NIST NVD), while Verizon's 2026 Data Breach Investigations Report found that only 26% of confirmed exploited vulnerabilities are ever fully remediated. More holes, closed more slowly. The cost side is just as stark: IBM puts the average data breach at $4.4 million, and Chainalysis counted roughly $3.4 billion stolen in crypto during 2025. Meanwhile, offense is collapsing in price. In April 2026, Anthropic reported that an AI agent found and exploited a 27-year-old OpenBSD flaw for under $50 in API cost, with no human in either step. Attackers are increasingly automated, and automated attackers do not wait for your next audit cycle. They read your diffs. The industry's answer so far has been static analysis in CI: pattern matchers that flag what they can grep for and stay silent about everything that requires understanding the system. Teams know the result well. A wall of low-confidence warnings, a `security-scan` check everyone learned to ignore, and the vulnerabilities that actually mattered sailing through because no pattern existed for them. Ozone is our answer: the engine we built for audits, kept on continuously. ## What Ozone is Ozone is an AI security engineer for every team. You connect a GitHub repository, and from that point on every pull request that opens (or receives new commits) is reviewed automatically. Findings land in two places: as a single comment on the pull request itself, and in a dashboard where your team can triage, discuss, and track them over time. The review is not a gate bolted onto CI. Ozone is a GitHub App, not a GitHub Action, so it consumes zero CI minutes and adds nothing to your pipeline. An "Ozone security review" check appears on the PR, and admins can make it required on protected branches if they want merges to wait for it. Reviews typically finish in a few minutes. Each finding arrives ranked by severity (High, Medium, Low, Info) with an explanation of how the code fails and a **Copy fix instructions** button that hands the repair to whatever coding agent your team uses. Re-reviews update the same comment in place, so the bot never piles up noise in your thread. And anyone with write access can steer the reviewer directly from the conversation: ``` text @ozone review # run a fresh review on this PR @ozone is the new endpoint authenticated for org admins only? @ozone help # list commands ``` Ozone acknowledges within seconds and answers by re-reading the code, not from memory of the last run. ## It investigates like a reviewer, not a linter The core design decision behind Ozone is that skimming a diff in one pass is the failure mode of AI code review. A model shown only the patch produces plausible-sounding noise, because vulnerabilities live in the interaction between the change and everything around it. So Ozone doesn't review the diff. It reviews the system the diff lands in. Every run clones the repository into a fresh, isolated sandbox that is destroyed when the run ends, and the agent investigates with real tools: file reads, greps, git history, call-path tracing. An orchestrator delegates to specialized subagents that explore the code, probe individual attack surfaces, and drive each suspicion to confirmed or refuted, in parallel across the change. Here is the kind of change that separates investigation from pattern matching. The diff is one line: ``` typescript // The entire visible diff in proxy.ts - const upstream = ALLOWED_UPSTREAMS[req.params.provider]; + const upstream = req.query.upstream ?? ALLOWED_UPSTREAMS[req.params.provider]; ``` To a diff-skimmer, this reads as a convenience fallback. To a reviewer who traces where `upstream` flows, it reads differently: ``` typescript // ❌ VULNERABLE: three files away, upstream reaches a server-side fetch async function forward(upstream: string, path: string) { // req.query.upstream is attacker-controlled → SSRF into the // internal network, including the cloud metadata endpoint return fetch(`${upstream}${path}`, { headers: internalAuthHeaders() }); } ``` Ozone reports that as a High finding with the full path from entry point to impact, because it followed the value from the route handler to the fetch. No signature for "SSRF introduced via optional query fallback" exists in any rule set; you find it by reading the code. Effort scales with risk, not diff size. Small changes get a quick pass and large ones the full treatment, but anything touching sensitive surfaces (authentication, crypto, permissions, IAM, secrets, migrations, CI workflows, dependency manifests, Dockerfiles, Terraform) jumps to full investigation no matter how small the diff is. A three-line change to a workflow file is riskier than a five-hundred-line feature, and the reviewer behaves accordingly. Two guardrails keep the trust boundary honest: draft PRs are skipped by default, and PRs from external forks are never reviewed automatically. A maintainer has to ask. Untrusted code cannot trigger anything on its own. ## The bar for a finding is deliberately high Every AI review tool eventually faces the same choice: say more and be ignored, or say less and be trusted. We chose trust, and we encoded it as a rule the agent cannot negotiate with: **a finding must be traceable from an attacker-reachable entry point to concrete impact.** Style nits, unverifiable suspicions, and theoretically-unreachable weaknesses are explicitly not findings. Internally we phrase it as: three confirmed, exploitable findings are worth more than twenty maybes. The corollary matters just as much. Ozone is biased toward approval, and a small, clean change deserves an empty findings list. A reviewer that must always say something trains your team to skim past everything it says. You can audit that bar yourself. Every run page shows the entire investigation as a live feed: every tool call, every delegation, every finding, inspectable afterwards. When Ozone reports something, you can see exactly how it got there. ## It learns your codebase between reviews A strong reviewer on day one is useful. A strong reviewer who knows your system is a different class of teammate, and this is where Ozone diverges most from scan-per-PR tools. Every project has a **knowledge library**: markdown documents about conventions, architecture, trust boundaries, and past decisions. The agent reads it before every review, so it arrives briefed on how your system actually works. Ozone also reads your repository's own agent instructions (`AGENTS.md`, `CLAUDE.md`, `CONTRIBUTING.md`), so the conventions you already wrote down shape the review. The library doesn't go stale, because maintaining it is itself agent work. A built-in nightly schedule keeps project knowledge current, and when your team marks a finding as a false positive, the triage note feeds back into knowledge so future reviews learn the pattern instead of repeating it. The findings themselves get the same treatment, because the industry's real bottleneck is not detection but prioritization and closure: when only a quarter of confirmed exploited vulnerabilities ever get fully fixed, a tool that only adds alerts makes things worse. A second nightly agent rechecks open findings against the current code and git history: it closes what it can prove resolved, merges duplicates by root cause, re-grades severity where the code has changed, and leaves the doubtful ones open. Every agent action carries an evidence note in an append-only activity trail, so the dashboard reflects reality instead of accumulating a landfill of stale alerts. Beyond per-PR reviews, you can sweep entire projects on demand or on a schedule, with up to 4,000 characters of custom instructions per run. Onboarding starts with a full first-principles analysis of your repository, mapping entry points and trust boundaries and probing each surface in proportion to risk. It runs up to 45 minutes and emails you when it lands. ## Web2 and Web3, one engine Cecuro comes from smart contract auditing, and Ozone reviews Solidity, Rust, Vyper, and Move with the same engine that ranks #1 on EVMBench, OpenAI's real-exploit benchmark. But Ozone also reviews the TypeScript, Python, Go, and Java around your contracts, and that is a deliberate security position, not a feature checkbox. Real exploits rarely respect the Web2/Web3 boundary. A leaked backend key drains a treasury. A compromised API feeds a bad price to a trusting contract. Consider a protocol whose contract accepts signed prices: ``` solidity // ✅ SAFE (in isolation): the contract verifies the oracle signature function pushPrice(uint256 price, uint256 nonce, bytes calldata sig) external { require(_verify(priceSigner, price, nonce, sig), "bad signature"); _updatePrice(price); } ``` Audited alone, this contract is fine. The vulnerability ships three weeks later in the *backend* repository: ``` typescript // ❌ VULNERABLE: the signer now trusts an upstream API response blindly async function publishPrice() { const { price } = await fetch(PRICE_API_URL).then(r => r.json()); // No sanity bounds, no deviation check: whoever controls or spoofs // PRICE_API_URL controls the on-chain price feed const sig = await signer.sign(encodePrice(price, nonce++)); await oracle.pushPrice(price, nonce, sig); } ``` A contract-only review never sees this change. A generic SAST tool sees no pattern to match. Ozone reviews both repositories in one project, can clone sibling repositories as read-only context so it understands how the pieces fit together, and models where the money moves across the whole system. ## How Ozone compares | | Point-in-time audit | Typical CI scanner (SAST) | Ozone | |---|---|---|---| | **Coverage window** | The code on audit day | Every PR | Every PR, plus scheduled whole-project sweeps | | **How it reads code** | Deep human/agent investigation | Pattern matching on known signatures | Sandboxed investigation: files, call paths, git history | | **Novel logic flaws** | Yes | No — no pattern, no finding | Yes — traced from entry point to impact | | **Signal quality** | High | Low; teams learn to ignore the check | Verification-first; clean PRs get an empty list | | **Knows your system** | During the engagement | No | Persistent knowledge library, updated nightly | | **Findings over time** | Static report | Alert pile-up | Self-maintaining: proven fixes close, duplicates merge | | **CI cost** | None | Consumes CI minutes | Zero (GitHub App, not an Action) | The right frame is not Ozone *versus* audits. A deep point-in-time audit before a major release and continuous review of everything that merges afterward are defense in depth, and high-value systems should have both. Cecuro delivers the former in hours, not weeks, at about 90% less than traditional cost: [start an audit](https://app.cecuro.ai). Ozone is how the same engine covers the other 364 days. ## Built for teams whose engineers are agents Everything the Ozone dashboard does is also a documented REST endpoint (OpenAPI spec included) and an MCP tool. That is the same capability surface Ozone's own built-in assistant uses, so your agents are first-class users, not an afterthought. Connecting from Claude Code is one line: ``` bash claude mcp add --transport http ozone https://ozone.cecuro.ai/v1/mcp \ --header "Authorization: Bearer oz_live_..." ``` From there your tooling can list findings, trigger runs, manage schedules, and file findings *into* Ozone from your own scanners, with the same triage and fix flow. API keys are org service identities with per-resource read/write grants, optionally confined to a single project, and sensitive account surfaces (credentials, billing, key management) stay browser-session-only, so no key can manage the org's own credentials. An append-only event ledger with cursor-based sync gives integrations exactly-once ordering across all resources. The same discipline applies inside the sandbox: review agents never hold your API key or a GitHub credential. Each run gets a short-lived credential scoped to its project and task that cannot outlive the run. Inside the app, the assistant is one `Cmd/Ctrl-K` away and acts with your permissions: it answers questions across runs, findings, and billing, starts and cancels runs, manages schedules, and hands code-level questions to the review agent, which re-clones the code and investigates for real. ## Pricing: a free tier and a meter, not a bundle Ozone's pricing is deliberately simple. The Standard tier is $0 per month, and connecting your first repository grants **$100 of review credit, valid 30 days, no card required**. When the credit runs out, add payment details and carry on: usage is metered in dollars and billed monthly, and every run reports its exact billable cost up front. The figure you see is the figure invoiced. No plan bundles usage. Pro, at $200 per month, buys throughput: 10 concurrent runs instead of 2, a 20-run queue, 500 reviews per rolling 24 hours instead of 20, 10 seats, and priority support. Both tiers meter usage at the same rate. Default monthly spend limits ($500 Standard, $1,000 Pro, raisable to $10,000) act as a brake, with email alerts as you approach them, so the meter can never surprise you. ## Frequently asked questions **Does Ozone replace our audit?** No, and it isn't trying to. An audit is a deep baseline on a fixed commit; Ozone reviews every change after it. High-value systems should have both. What Ozone replaces is the coverage gap between audits. **Will it spam our pull requests?** One sticky comment per PR, updated in place on re-reviews. Findings must trace from an attacker-reachable entry point to concrete impact, and a clean PR gets an empty findings list. You can also route findings to the dashboard only, per repository. **What about PRs from forks?** Never reviewed automatically. A maintainer must explicitly request a review, so untrusted code cannot trigger anything. **Which languages does it cover?** Smart contract languages (Solidity, Rust, Vyper, Move) and the application languages around them (TypeScript, Python, Go, Java, and more). Reviews are not limited to a fixed rule set, so coverage follows the code, not a signature database. **Can we control what gets reviewed?** Yes: per-repository triggers (every PR, mention-only, or off), base branch rules, include/exclude paths, skip labels, skip authors, draft handling, and a maximum changed-file threshold. ## Get your first review in minutes Getting started takes less time than reading this post did: 1. Sign in with GitHub or Google at [ozone.cecuro.ai](https://ozone.cecuro.ai) 2. Install the GitHub App and pick the repositories to connect 3. Ozone starts a baseline analysis of your codebase and emails you the results 4. Open a pull request. The review is already running The cheapest vulnerability to fix is the one that never reaches production. Until now, catching it there meant either an audit timed exactly right or a human security engineer reading every PR. Ozone makes that engineer something every team has. **[Start free with $100 of reviews →](https://ozone.cecuro.ai)** *Shipping a protocol or a major release? Pair continuous review with a deep audit from the same #1-ranked engine: [app.cecuro.ai](https://app.cecuro.ai).*