AI security review
Find what attackers find.
Drop in source files or pull a GitHub repository. Sentinel runs a deterministic rule engine, then an AI auditor, and verifies every finding against your actual code before it reaches the report.
- Verified evidence, not guesses
- TypeScript · Python · Rust · 20+ languages
- Read-only scans · verified fix branches
Add code to scan
Drop source files here
or choose files from your device
TypeScript, JavaScript, Python, Rust, Go, Java, C/C++, C#, Ruby, PHP, Swift, Kotlin, SQL, shell and more. Max 20 files, 250 KB each.
Private repo? Add a read-only token
Sent straight to api.github.com from this tab. Held in memory only, never saved, never sent anywhere else.
Read-only token in memory
Source files
Scan queue
Agent running
Scanning your code
The agent is reviewing your files in passes.
- Ingest and validate files
- Rule engine sweep
- Agent hunt with tools
- CVE and dependency intel
- Independent verification
- Prepare verified patches
- Build report
Activity
Verified security review
Security report
Risk score
0 Findings
Independent verification
- Confirmed
- 0
- Needs review
- 0
- Rejected
- 0
- Highest CVSS
- 0.0
Findings the verifier rejected
Dependency intelligence
Agent activity
Every tool call the agent made while reviewing your code, in order.
Remediation
Fix, verify, then push
Proposed patches
No automatic patches for this scan. Use the fix guidance on each finding.
Push verified fixes
Creates a new branch and a pull request. Your default branch is never modified.
How Sentinel works
Sentinel is a two-layer security review that runs on demand.
1. Ingest — files are validated in your browser; unsupported or binary files are rejected.
2. Rule engine — deterministic checks for injection, secrets, unsafe deserialization, TLS mistakes and other known patterns in TypeScript, JavaScript, Python and Rust.
3. AI auditor — a security-focused model reviews the code for logic flaws and language-specific risks, including Go, Java, C/C++, C#, Ruby, PHP, Swift and Kotlin.
4. Verification — every AI finding must point to a line that actually exists in your code, or it is discarded.
GitHub access uses the public API with your permission. Tokens are optional, read-only and never stored.
5. Deep analyst — the agent can list files, read code, grep for sinks, look up CWEs and search live CVE records before it reports anything.
6. Independent verifier — a second model tries to disprove each finding, assigns a CVSS 3.1 score, and rejects weak claims.
7. Push — applied fixes are re-checked by the rule engine, then committed to a new branch with a pull request. Your default branch is never touched.