Security signals live beyond the dependency graph.
ZeroPatch follows the configuration that turns a dependency into a running system. When an advisory points to a wider remediation, these are the surfaces where the patch needs to land.
Find the change where the advisory becomes an engineering task.
Three connected surfaces
Follow the advisory to the place it matters.
Each surface carries a different kind of operational risk. The signal is useful when it arrives with enough context to become a focused, reviewable patch.
Container images
ZeroPatch follows the image references that move your application from a base layer to a deployable artifact, so a patch does not stop at the lockfile.
Advisory signal
A vulnerable base-image digest or tag update lands in a Dockerfile.
IaC configs
Infrastructure-as-code changes are part of the remediation surface too. ZeroPatch connects advisory context to the provider, module, and chart definitions that shape runtime systems.
Advisory signal
A Terraform provider, module, or Helm dependency changes in response to an advisory.
GitHub Actions workflows
Your CI workflow is production infrastructure. ZeroPatch watches action references in the automation that builds, tests, signs, and ships every patch.
Advisory signal
A vulnerable action ref or pinned SHA is updated in a workflow file.
The useful unit
An advisory is only closed when the system is patched.
ZeroPatch keeps the signal attached to the files and references your team actually ships. That makes the remediation path visible from first clue to merged change — across code, infrastructure, and delivery.