Sentinel AI Code Security

Sentinel AI Code Security

v1
by
b
blueparasite
Sentinel AI Code Security
Loading...
Sentinel AI code security
Agent online How it works

AI security review

Find what attackers find.

Drop in source files or pull a GitHub repository. Sentinel runs a deterministic rule engine, then an AI auditor, and verifies every finding against your actual code before it reaches the report.

  • Verified evidence, not guesses
  • TypeScript · Python · Rust · 20+ languages
  • Read-only scans · verified fix branches

Add code to scan

Upload files GitHub repo

Drop source files here

or choose files from your device

Choose files

TypeScript, JavaScript, Python, Rust, Go, Java, C/C++, C#, Ruby, PHP, Swift, Kotlin, SQL, shell and more. Max 20 files, 250 KB each.

Load a vulnerable sample

Repository
Load repository

Public repos work without a token. Use a fine-grained token with read-only Contents access for private repos.

Private repo? Add a read-only token
Fine-grained token
Forget token

Sent straight to api.github.com from this tab. Held in memory only, never saved, never sent anywhere else.

Read-only token in memory

Read-only access

Source files

Select all Clear

    Add selected files

    Scan queue

    Clear all

      Agent running

      Scanning your code

      The agent is reviewing your files in passes.

      1. Ingest and validate files
      2. Rule engine sweep
      3. Agent hunt with tools
      4. CVE and dependency intel
      5. Independent verification
      6. Prepare verified patches
      7. Build report

      Activity

        New scan
        Fix & push Copy report Download .md

        Verified security review

        Security report

        ·

        0 /100

        Risk score

        Critical0
        High0
        Medium0
        Low0

        0 Findings

        Independent verification

        Confirmed
        0
        Needs review
        0
        Rejected
        0
        Highest CVSS
        0.0

        Findings the verifier rejected

          Dependency intelligence

            All0 Critical0 High0 Medium0 Low0
            Search findings

            Agent activity

              Every tool call the agent made while reviewing your code, in order.

              Remediation

              Fix, verify, then push

              Apply ready fixes Reset

              Proposed patches

                No automatic patches for this scan. Use the fix guidance on each finding.

                Push verified fixes

                Creates a new branch and a pull request. Your default branch is never modified.

                Repository Branch name Pull request title GitHub token

                Fine-grained token with Contents and Pull requests read/write. Used once, kept in memory.

                Push verified fixes

                Open pull request Copy link
                Scan again

                Runs in your browser. Nothing is scanned without your action.

                Sentinel · AI code security

                How Sentinel works

                ×

                Sentinel is a two-layer security review that runs on demand.

                1. Ingest — files are validated in your browser; unsupported or binary files are rejected.

                2. Rule engine — deterministic checks for injection, secrets, unsafe deserialization, TLS mistakes and other known patterns in TypeScript, JavaScript, Python and Rust.

                3. AI auditor — a security-focused model reviews the code for logic flaws and language-specific risks, including Go, Java, C/C++, C#, Ruby, PHP, Swift and Kotlin.

                4. Verification — every AI finding must point to a line that actually exists in your code, or it is discarded.

                GitHub access uses the public API with your permission. Tokens are optional, read-only and never stored.

                5. Deep analyst — the agent can list files, read code, grep for sinks, look up CWEs and search live CVE records before it reports anything.

                6. Independent verifier — a second model tries to disprove each finding, assigns a CVSS 3.1 score, and rejects weak claims.

                7. Push — applied fixes are re-checked by the rule engine, then committed to a new branch with a pull request. Your default branch is never touched.

                Got it