0 is the open-source security harness from 0.security, a Y Combinator Fall 2026 company, for engineers and researchers who need to find vulnerabilities and check that a proposed fix works. You install it locally, connect your own model, and work in a browser console, from the CLI, or through MCP with a coding agent. Workflows cover source review, web and API testing, binary analysis, and kernel research. Parallel agents investigate a lead, try to reproduce it, and test a patch. This launch publishes the harness behind the company’s own disclosures, so other teams can run it instead of waiting on a vendor scan. Its public track record lists more than 30 merged Linux kernel zero-days, a certificate-chain validation bypass in node-forge, a heap out-of-bounds write in Wireshark’s ciscodump extcap, arbitrary code execution through crafted expressions in jsonata, and an anonymous API endpoint that leaked exception detail in Swiss Federal Chancellery code. The company also reports previously unknown vulnerabilities in government software across multiple countries and in software running on more than 3 billion devices. Co-founders Doruk Tan Ozturk and Fabian Zbinden are a two-person team. Ozturk, the CEO, previously worked as a cyber defense engineer at the largest Swiss conglomerate retailer. Zbinden previously built Mellivora Capital and was an early hire at Crypto Finance, which was sold to Deutsche Börse. They also offer 0cloud, a hosted product that runs this testing against connected repositories.