SentinelForge

SentinelForge is a local-first security release checker for software you own or are clearly allowed to test.

It helps developers catch common security mistakes before shipping code.

It does not prove an app is perfectly secure. It gives you a practical first-pass security baseline, a risk score, and a plain-English report.

Who this is for

• Developers scanning local repositories
• Teams adding a lightweight CI security gate
• Maintainers checking dependencies, secrets, and deployment files
• Builders reviewing AI/LLM application risks in code they own

What SentinelForge checks

SentinelForge v1.5 includes:

• Static code pattern checks
• Dependency risk checks
• Secrets detection with redaction
• Docker/IaC misconfiguration checks
• Safe local/staging dynamic baseline checks in standard mode
• AI/LLM app security checks
• API route inventory checks
• CISA KEV known-exploited enrichment support
• Policy files and suppression files
• GitHub Actions setup helper
• Plain-English finding explanations
• HTML, Markdown, JSON, and badge report outputs
• Authorization guardrails for URL targets
• OWASP Top 10 2025, OWASP API Top 10 2023, OWASP LLM Top 10 2.0, and CISA KEV-aware reporting structure
• Risk score and A+ to F grade

Beginner start

If you know almost nothing about computers, start here:

1. Read BEGINNER_GUIDE.md
2. Install the package from the GitHub release
3. Run this command:

sentinelforge doctor

4. Scan a project you own:

sentinelforge scan --target ./your-app --mode static

5. Open the report:

reports/latest_report.md

Install

Download the latest wheel from the GitHub Releases page, then install it with pipx or uv tool install.

Example with pipx:

pipx install ./sentinelforge-1.5.1-py3-none-any.whl

Example with uv:

uv tool install ./sentinelforge-1.5.1-py3-none-any.whl

Full beginner install instructions are in:

INSTALL_SENTINELFORGE_v1.5.md

Run

SentinelForge includes free forever trust commands such as --help, doctor, explain, init-policy, init-ci, license-status, and activate.

You also get one full local scan trial. After the trial scan is used, continued full scans require an activated SentinelForge license.

Static local repository scan:

sentinelforge scan --target ./my-app --mode static

Safe local or explicitly authorized staging baseline:

sentinelforge scan --target ./my-app --mode standard --url http://localhost:3000

Public URL dynamic scans are blocked unless you explicitly confirm authorization:

sentinelforge scan --target ./my-app --mode standard --url https://staging.example.com --i-am-authorized --allow-public-target

Reports are written to:

• reports/latest_report.md
• reports/latest_report.json
• reports/latest_report.html

Sample report

Want to see what a report looks like before installing?

Read:

docs/SAMPLE_SECURITY_BASELINE_REPORT.md

Short example result:

Score: 11.75 / 100
Grade: F
Decision: Do Not Ship
Top risks: shell command execution, suspected hardcoded secret, debug mode, outdated dependencies, risky Docker settings

Safety rules

Only scan software you own or have clear written permission to test.

SentinelForge blocks public dynamic scans by default and only allows low-impact local/staging baseline checks unless explicit authorization flags are provided.

SentinelForge does not perform exploit chains, credential theft, persistence, lateral movement, denial-of-service testing, destructive payloads, or unauthorized production scanning.

What SentinelForge does not promise

SentinelForge does not guarantee that software is secure.

It does not replace:

• A professional penetration test
• A full manual code review
• A full compliance program
• Production monitoring
• Business-logic abuse testing by an expert

Correct promise:

SentinelForge helps catch common and high-risk security mistakes before you ship.

Useful commands

Check scanner readiness:

sentinelforge doctor

Create a starter policy file:

sentinelforge init-policy

Create a GitHub Actions workflow:

sentinelforge init-ci

Check trial/license status:

sentinelforge license-status

Activate a license key after receiving one from the maintainer:

sentinelforge activate YOUR-LICENSE-KEY

Explain one finding in plain English:

sentinelforge explain --report reports/latest_report.json --finding-id static-001

Fail CI/CD if a report is below a minimum grade:

sentinelforge gate --report reports/latest_report.json --minimum-grade B

External scanner tools

SentinelForge includes wrappers for these tools and reports them as missing if not installed:

• Semgrep
• Bandit
• OSV-Scanner
• Trivy
• Gitleaks

Missing tools do not stop SentinelForge. Scans are stronger when the tools are installed.

Grade meaning

• A+ / A: low risk detected by configured scanners
• B: some issues; fix before public launch if internet-facing
• C: moderate risk; fix before serious users
• D / F: do not ship

License

MIT License. See LICENSE.