Unlike scanners that provide risk opinions, Sentinel delivers authoritative decisions. Every execution results in exactly one of two states.
Zero violations detected. Code meets all security policies. Pipeline proceeds without interruption.
Critical violations detected. Pipeline terminates immediately. Alert created in GitHub Issues with full details.
Overridden violation with formal justification in sentinel.yaml. Pipeline proceeds with full audit trail.
Violations cannot be silently ignored. Every exception must be formally justified in sentinel.yaml — creating an immutable audit trail visible to administrators.
Two enforcement layers — pre-commit hook for local development, CI/CD pipeline for every push.
Installed by start.sh in .git/hooks/pre-commit. Fires before every commit — developer cannot bypass without explicit --no-verify flag (which triggers CI/CD alert).
Full 11-engine scan runs internally — Bandit, Semgrep, Gitleaks, Secret Detector, CICD Analyzer, IaC Scanner, Dependency Scanner and more. Same engine, same WSPM v2.2 scoring. Every blocked commit report includes a PDF Evidence Appendix with source-level code context for CRITICAL/HIGH findings, and compliance tags (SOC 2 TSC · CIS Controls v8 · ISO/IEC 27001:2022).
Gemini 2.5 analyzes critical findings — eliminates false positives before policy enforcement. Groq (Llama 3.3 70B) takes over automatically if Gemini quota is exhausted.
Every blocked commit automatically creates a GitHub Issue in the admin repository — machine identity, developer username, timestamp, violation details. Immutable audit trail.
GitHub Actions workflow runs sentinel scan . on every push. Even if a developer bypasses the local hook, the CI/CD gate blocks the push and alerts the admin.
Policy-driven enforcement — each rule maps to a specific threat class with configurable BLOCK / WARN response.
AWS keys, API tokens, private keys, passwords hardcoded in source files or committed to git history.
Mutable :latest tags prohibited. Pinned digest versions enforced for build reproducibility.
SHA pinning enforced for all GitHub Actions — prevents supply chain attacks via compromised action versions.
runAsNonRoot and resource limits enforced in all K8s manifests. Privilege escalation blocked.
Unencrypted MQTT connections and insecure broker configurations in IoT infrastructure code.
Unpinned dependencies, known CVEs in requirements. Prevents vulnerable packages from entering the build.
Sentinel forbids all unsanctioned network access at runtime by design. Safe for air-gapped environments.
No usage data collected. Sentinel operates without phoning home under any circumstance.
Operates without internet access. Safe for classified, banking, and high-security internal environments.
Never self-updates or pulls remote rules at runtime. Security logic is Cython-compiled and guaranteed.
Each license is cryptographically tied to your machine's hardware identifier. Non-transferable by design.
Run on every machine where Sentinel will be deployed:
Email your Machine ID to [email protected]. You will receive a License Key unique to that machine.
Installs Sentinel, configures .env, sets up pre-commit hook and CI/CD workflow automatically.
Expected: commit blocked, GitHub Issue created, alert sent.
Every improvement to Auditor Core v2.2 propagates automatically to the enforcement gate.
Every blocked commit report now includes source-level code context for CRITICAL/HIGH findings — audit-defensible out of the box.
Every finding tagged to specific controls in JSON and PDF output. Compliance tags included in every GitHub Issue alert.
Effective grade capped at C when CRITICAL findings exist in production code — regardless of SPI score.
NON_RUNTIME context for test/, docs/, examples/ excluded from SPI. Taint analysis and reachability scoring applied before enforcement.
Multiple findings in the same file grouped as one block with line list in PDF output. NUL-byte sanitization prevents binary files from causing scan failures.
Delivered as .so compiled modules for IP protection. Consistent verdict labels across PDF and HTML report formats.
A developer can run git commit --no-verify locally. However, the CI/CD pipeline catches the push, blocks it, and sends an alert to the administrator with the developer's identity, machine ID, and timestamp.
Basic scanning takes 2–5 seconds on typical projects. With Gemini AI analysis enabled — 15–30 seconds depending on project size and number of findings sent for verification.
Groq (Llama 3.3 70B) takes over automatically. If both are unavailable, Sentinel continues operating without AI enrichment — all core enforcement rules run fully offline at all times.
Yes. Every blocked commit is recorded as a GitHub Issue with machine identity, username, timestamp, and violation details — creating an immutable audit trail. Developers have no access to the enforcement dashboard.
Auditor Core is a deep audit engine — run on demand to produce comprehensive posture reports with SPI score. Sentinel is a real-time enforcement gate that intercepts every commit. Sentinel uses Auditor Core internally as its scanning engine.