Find signs of a web shell before an attacker does.
Paste a PHP file or open one from your device. Sentinel will analyze the code without executing it and explain how to safely mitigate the risk.
The tool does not connect to third-party sites, does not execute PHP, and does not create shellcode. Use it only for systems you own or manage.
Source PHP Code
Analysis rules run in the browser. The draft is stored on this device; code is sent to AI only upon your request.
Scan Results
Code has not been verified yet
Run a local analysis to see found signals and recommendations.
No danger signals detected. Still, check dependencies and access rights.
File Upload Audit
Check the upload handler and web server rules without network requests. Sentinel looks for Unrestricted File Upload conditions and generates a secure fix plan.
Upload Control
Run a dry-run to check filtering, names, MIME types, and isolation.
Authorized verification plan
Build a step-by-step dry-run for a local or staging environment. The fields below are used only as notes: Sentinel does not send or open anything.
Safe sequence of actions
Specify environment parameters and confirm permission to get a local checklist.
Safe Remediation
AI will explain the findings and suggest a safe cleanup plan. It does not edit or enhance the web shell.
When requesting AI, the selected code snippet is sent to the connected AI service for processing; do not send secrets or keys.
Recent scans
Your local scan results will appear here.