DL Sentinel
DL Sentinel is a security scanner for your own code. It reads a project folder, looks for exposed secrets, known-vulnerable dependencies, insecure code patterns, risky container and infrastructure settings, weak API definitions and smart-contract risks, and reports what it finds. It runs on your machine and never sends your code anywhere.
Beta
DL Sentinel is in beta. Version 0.1.0 is the first release. Command names and report fields may still change between releases.
What it does
- Scans a folder with six scanners. One command,
sentinel scan ., runs every scanner over the folder. There are 88 rules in total, and 76 of them are mapped to CWE and OWASP Top 10 (2021) categories. - Writes reports four ways. A short summary in the terminal, or a full report as JSON, Markdown or SARIF 2.1.0 (the format GitHub code scanning reads).
- Gates a build. The exit code tells a CI pipeline whether the scan found anything at the severities you chose, so a pipeline can fail on new critical or high findings.
- Lets you adopt it on an old codebase. A baseline records today's findings, so later scans report only new ones. Suppressions in
sentinel.ymlhide findings you have reviewed, with an optional expiry date. - Checks pull requests on GitHub. A GitHub Action reports only what a pull request adds, posts a comment and writes a SARIF file.
- Runs as a small server. An optional self-hosted server adds an HTTP API and a web dashboard with a scan queue, schedules, history and user roles.
The six scanners
| Scanner | Id | Looks at |
|---|---|---|
| Secrets | secrets | Every text file, for API keys, tokens and passwords |
| Dependencies | dependencies | npm, pip, Go and Cargo manifests and lockfiles |
| Source code | source | JavaScript, TypeScript, Python, Go, Ruby, PHP and Java |
| Infrastructure | infra | Dockerfiles, Compose files, Kubernetes manifests, Terraform |
| API | api | OpenAPI, Swagger and Postman collection files |
| Smart contract | smart-contract | Solidity (.sol) files |
See The scanners for what each one checks.
How it treats your code
- Scanning is local and offline. There is no account, no telemetry and no database.
- The scanned code is never run. Symbolic links are never followed.
- Secret values are replaced with
[REDACTED]before they reach a finding, so a report never contains the secret itself. - The only network use is opt-in: online vulnerability data for dependencies, server notifications, and the GitHub Action's pull-request comment.
Scan only what you may test
Scan code that you own or that you have permission to test. DL Sentinel is a static scanner: it reads files and does not attack running systems, but its reports describe weaknesses, so treat them as sensitive.
What it is not
DL Sentinel finds patterns; it does not prove anything. A finding is a lead to check, not proof of a vulnerability, and a clean report does not mean a project is secure. Rules are tuned to report less rather than guess.
Who it is for
- Developers who want to check their own repository before they push.
- Teams who want a security check in CI without sending source code to an outside service.
- Anyone learning what common security mistakes look like in real files.
Platforms
Linux on x64 and arm64, with Node.js 20 or later. Version 0.1.0 is installed from source. The optional server also runs in Docker. Windows is not tested.