Sentinel scans your dependencies, containers, and IaC on every commit — and tells you what's exploitable, not just what's flagged.
Securing the pipelines at
Drop it in CI, or run it locally — no agent, no sidecar.
# install and scan
npx @sentinel/cli scan
✓ 1,284 dependencies analyzed
✓ 3 exploitable issues (of 41 flagged)
→ sentinel.security/r/9f2a — fix PRs readyWorks with npm, PyPI, Go, containers, and Terraform.
Noise filtered out, exploitable risk surfaced first.
We trace whether a vulnerable function is actually called — so you fix the 3 that matter, not the 41 that don't.
Base images and layers, on every build.
Terraform misconfigs and leaked keys, caught in PR.
We open the upgrade PR with the patch and the changelog — you just review and merge.
Generate an SBOM and evidence for SOC 2 in a click.
“Our scanner flagged forty-one CVEs a build and we chased every one. Sentinel's reachability analysis showed three were actually exploitable — the backlog stopped being a full-time job in a week.”
The evidence your auditors ask for, generated automatically
The CLI runs where your code does — in your CI or on your machine. By default we receive only the dependency graph and finding metadata, never source. Self-hosted runners keep everything inside your perimeter; the cloud dashboard sees results, not code.
Reachability re-ranks findings — it never hides them. Every flagged CVE stays in the Findings view with its reachability verdict shown; you decide what to mute. If a call graph is ambiguous, we mark it 'reachable — unconfirmed' rather than clearing it.
Scanning is static: it reads your lockfiles, image layers, and Terraform in CI, so there's nothing to install on production hosts. Runtime signals (which images are actually deployed) come from your registry and orchestrator via read-only tokens, not an agent.
No. Sentinel opens the PR with the version bump, the changelog, and a passing test run — a human reviews and merges. Auto-merge is opt-in per repo and only for patch-level upgrades you've allow-listed.
Public repositories are free, unlimited. Private repos are priced per active repo per month, not per developer or per scan — so turning on scanning for the whole org doesn't turn into a surprise invoice.
Run your first scan free. No agent, no card, no 'book a demo' wall.
Free for open source · SOC 2 Type II