Sentinel finds the authorization and configuration flaws that quietly expose small-business and BaaS apps — the ones a generic vulnerability scanner misses — and gives you a clear go/no-go verdict before you launch.
Most breaches at this scale aren't exotic exploits — they're broken access rules and misconfigured backends. That's exactly what Sentinel checks.
Supabase RLS bypass, Firebase rules, GraphQL introspection/aliasing, Appwrite roles — the real ways a "backend-as-a-service" app leaks other users' rows.
Passive, non-intrusive checks for exposed files, misconfig, weak headers and known-vulnerable dependencies (live OSV feed).
BaaS-aware static analysis in your CI: service_role keys in the client, auth != null rules, USING(true) RLS, JWT-decode-without-verify. SARIF + JUnit.
One combined go/no-go decision folding authorization, performance and integration results — not a pile of disconnected reports.
Scheduled re-scans with change alerts, and a self-hosted out-of-band collaborator to confirm blind SSRF/RCE on assets you own.
API tokens, JUnit and SARIF output, and CLI runners so checks run in your pipeline — your source never leaves it.
Sign up free — your data lives in its own isolated database.
Prove you own the domain to unlock monitoring and active testing.
External scan, deep BaaS engine, code scan, performance.
A single go/no-go decision you can hand to your team.
Start free. Upgrade when you need more targets, deep engines, monitoring and seats.
Loading plans…
No — Sentinel automates the highest-frequency, highest-risk checks (especially authorization and BaaS misconfig) and gives you a launch verdict. For regulated or high-stakes systems, use it alongside a manual pentest; it also has a CREST-aligned engagement workflow for professional testers.
Only assets you own or are explicitly authorized to test. Active testing (DAST, deep engines, load) is gated behind proof of domain ownership, and every run is recorded in an authorization audit trail.
Only if you use the optional code (SAST) scanner in your CI — and there the source never leaves your pipeline. Secrets you provide (anon keys, tokens) are encrypted at rest and never returned to the browser.
Yes. Sentinel is a single zero-dependency Node.js app with Docker/Caddy deployment. Self-hosted installs run unlimited and unbilled.
Create a free workspace and run your first check in minutes.