Your code ships fast.
Sentinel keeps watch.
Leaked secrets, vulnerable dependencies, insecure code, end-of-life technology and every AI model and agent your teams wired in, found across every repository. Each finding comes with an owner, a risk score and an audit trail. Secret values are never stored.
We pointed Sentinel at every repository we own.
Before asking anyone else to trust it, we ran it on all twelve of Pyxion's repositories in October 2026, then fixed what made it noisy or slow.
A thousand advisories can hide the one key that matters.
In our first scan, dependency advisories were 85% of everything found. Seven findings were about secrets. Sentinel's risk score counts each issue once at its worst, so one advisory repeated across ten lockfiles cannot bury a leaked credential.
How scoring worksOne finding model for everything a repository can get wrong.
Ten sources normalised into eight categories. Pick one to see what Sentinel reports.
Secrets and credentials
Keys and tokens anywhere in git history, plus committed .env and credential files. Reported by path and commit, never by value.
Vulnerable dependencies
Known advisories in every tracked lockfile. Development-only packages and unpinned versions are labelled, so a test tool or a guessed version does not read like a production emergency.
Code security
Static analysis with community rules plus rules written from real incidents, such as unescaped JSON in pages and model output rendered as HTML.
AI security
An AI bill of materials per repository: AI SDKs, model identifiers, MCP server configs and agent instruction files. Flags unpinned MCP servers and user input in system prompts.
Next: Agent permissions through rules files, skills and connectors; prompt-injection exposure.
Outdated and end-of-life technology
Container base images and runtimes checked against published end-of-life dates.
Ownership and review
Every repository has an accountable owner; missing CODEOWNERS and unowned code are findings.
SDLC and AI development standards
Unpinned dependencies, missing lockfiles and repository rules such as migration naming limits.
Next: Checks for AI-assisted development practices across the lifecycle.
Privacy and data protection
Next: Personal data in code, logs and AI prompts.
From checkout to decision on record.
Scan
Pinned engines run in isolated containers with your code mounted read-only.
Normalise
Every result becomes one finding with a stable fingerprint, a category and a severity in context.
Own
Each repository has an accountable owner and a risk score your leadership can read.
Decide
False positive or accepted risk, with a reason and an expiry. Who, when and why is never overwritten.
A workspace for your organisation.
Viewers see findings, triagers record decisions, admins manage people and scanner tokens. Each organisation sees only its own data, behind a sign-in pool with multi-factor authentication.
Roles
Viewer, triager, admin.
Audit log
Every sign-in, upload and decision.
Straight answers.
Do you store our secrets?
No. Secret scanning runs with redaction on, and Sentinel records only the file path, rule and commit. The value never leaves the scanner.
Does Sentinel need write access to our repositories?
No. It reads a checkout and mounts it read-only into each scanner. It never edits, commits or runs your code.
Where is data held?
Findings are stored in the EU (AWS eu-west-1, Ireland). Each organisation sees only its own findings.
How do people sign in?
Through a dedicated sign-in pool with multi-factor authentication. Accounts are created by your administrator; there is no open sign-up.
Is it available now?
Sentinel is in early access. We run it on all of our own repositories and are onboarding a small number of teams.
Put a sentinel on every repository.
We are onboarding a small number of teams. Tell us what you want watched.
Request early access