# Pyxion Sentinel

> Pyxion Sentinel scans your repositories for leaked secrets, vulnerable dependencies, insecure code, end-of-life technology and AI usage, puts every finding in one model with an owner and a risk score, and keeps an audit trail of every triage decision. Secret values are never stored.

Pyxion Sentinel is made by Pyxion (https://pyxion.uk) and is in early access.

## Pages
- [Features](https://sentinel.pyxion.uk/features): what it checks today and what is next
- [Security](https://sentinel.pyxion.uk/security): how code, secrets, findings and sign-in are handled
- [Pricing](https://sentinel.pyxion.uk/pricing): early access; prices not yet published
- [Request early access](https://sentinel.pyxion.uk/early-access)

## What it checks today
- Secrets and credentials: Keys and tokens anywhere in git history, plus committed .env and credential files. Reported by path and commit, never by value.
- Vulnerable dependencies: Known advisories in every tracked lockfile. Development-only packages and unpinned versions are labelled, so a test tool or a guessed version does not read like a production emergency.
- Code security: Static analysis with community rules plus rules written from real incidents, such as unescaped JSON in pages and model output rendered as HTML.
- AI security: An AI bill of materials per repository: AI SDKs, model identifiers, MCP server configs and agent instruction files. Flags unpinned MCP servers and user input in system prompts.
- Outdated and end-of-life technology: Container base images and runtimes checked against published end-of-life dates.
- Ownership and review: Every repository has an accountable owner; missing CODEOWNERS and unowned code are findings.
- SDLC and AI development standards: Unpinned dependencies, missing lockfiles and repository rules such as migration naming limits.

## Coming next
- Scheduled scans and alerts when a new critical appears
- Deploy gates: block a release on open criticals, with approvals
- AI governance: what each agent may read, write and call
- Token-level AI cost per repository, team and feature
- Semantic and model monitoring for AI features in production
- Code health trends alongside security
- Visibility of your products in AI assistants, measured alongside risk

## Questions
### Do you store our secrets?
No. Secret scanning runs with redaction on, and Sentinel records only the file path, rule and commit. The value never leaves the scanner.

### Does Sentinel need write access to our repositories?
No. It reads a checkout and mounts it read-only into each scanner. It never edits, commits or runs your code.

### Where is data held?
Findings are stored in the EU (AWS eu-west-1, Ireland). Each organisation sees only its own findings.

### How do people sign in?
Through a dedicated sign-in pool with multi-factor authentication. Accounts are created by your administrator; there is no open sign-up.

### Is it available now?
Sentinel is in early access. We run it on all of our own repositories and are onboarding a small number of teams.