Sentrint helped me detect several key security vulnerabilities in a vibe coded personal agent I had built for myself. The agent’s vulnerabilities had the potential to leak a lot of private and sensitive data, which were quickly resolved. I’m glad I found this product!!
without losing sleep
Sentrint scans the GitHub repo behind an app you built with any of the 16 AI coding tools it supports. It checks the code for hardcoded secrets, database access rules, vulnerable dependencies and risky code paths. An AI review then rechecks a capped number of findings against your code to cut false positives. You get a score out of 100, each finding in plain English, and a fix prompt written for the tool that built the app. Apply the fix and scan again to see what changed. It reads code only: it does not run your app or test the live site.
AI-written code can pass every test and still leak secrets, leave your database open or skip login checks. Sentrint finds them before anyone else does, fix included.
Or scan from your coding agent:
npx -y @sentrint/mcp
Or see a live demo first Google Cloud Google for Startups Cloud Program
Single-use Instance
Deleted Your clone
Read-only Repo access
Read the commitments
- Cursor
- Windsurf
- GitHub Copilot
- Cline
- Replit
- Claude Code
- Lovable
- Bolt
- v0
- Base44
- DeepSeek
- Claude
Names and logos belong to their owners. Sentrint is not affiliated with them.
Why this matters #
AI coding tools write code that runs. Sentrint reads it for what it exposes: leaked keys, open database rules, unguarded routes, and the fix for each.
98%
of 1,072 Supabase-backed apps built with AI coding tools had at least one security issue. 26 had none.
of 20,052 indie launch URLs exposed Supabase credentials in frontend code. The anon key is meant to be public. A service_role key never is.
SupaExplorer 1.5M
API tokens and 35,000 email addresses exposed by Moltbook, a vibe-coded app, days after launch. Its Supabase tables had no RLS policies.
What our users are saying #
I am a non technical guy doing a project that has the potential to become a good product. I have little knowledge in cybersecurity and don’t have the funds to get a professional. I had mistakenly thought Claude can do things for me. I know better now thanks to a costly mistake. Apparently I have to know what issues to fix and then instruct AI to do it. This is where Sentrint became my go to. It has a lot of rules baked into the product that can check these issues for me. I’m satisfied and I would recommend Sentrint to all non tech people out there who is new to product building.
Easy to find code vulnerabilities, detect where code lacks and need further improvements.
What one scan gives you #
01 · Risks
Every security risk across your repos, worst first
37.6%
more critical vulnerabilities after five rounds of AI edits, in a controlled study of 400 code samples. Shukla et al., 2025
Scan again and it tells you what you fixed and what is new.
02 · All findings
Each vulnerability explained in plain English
44%
of tested AI code-generation tasks produced code with a known vulnerability. Veracode, 2026 Each row says what the AI review made of it: confirmed, unclear or a false positive.
03 · Finding detail
Open a finding to see the file, the line and the risk
88%
of 10,616 publicly leaked AWS keys still worked when researchers tested them again. Truffle Security, 2026 Leaked keys get tested, so you know which one to rotate first.
04 · Attack path
How an attacker could reach the flaw
T1190
Exploit Public-Facing Application. Every step names its MITRE ATT&CK technique.
It shows the likely route, not proof that this one is exploitable.
05 · Fix prompt
A fix prompt for the AI tool that wrote the code
16
AI coding tools, each with a prompt phrased for it.
Ordered by what is exploitable now, and told to change nothing else.
06 · Code map
A map of your code that shows which files to fix first
94
files drawn as one graph, sized by risk, in a real scan of a public practice repo.
Files are ranked by what they cost your score.
07 · Audit logs
A log of every scan, sign-in and change
90 days
of sign-ins, scans, status changes and API keys, kept and searchable.
Every view downloads as CSV or JSON, and the download is logged too.
08 · Badge
A README badge that shows your current grade
A to C
are the only grades a badge shows. Below C it reads unrated.
It reads the live grade every time the README loads.
09 · MCP
Scan from your AI agent, without leaving the chat
5
tools your agent can call: start a scan, check it, read the findings, get the fix prompt, list past scans.
Findings come back with the file and line, so the agent can fix them in place.
Three passes over your code, only the first one decides #
01 No AI
The engine finds it
- Fixed rules, over your code and your lockfiles
- A rule matches or it does not
- Nothing here can be talked into a finding
02 AI
A second read cuts the noise
- Every critical and high finding, read a second time
- Cannot invent one. Cannot take one off your report
- Decides what earns a place in the fix prompt, and says how many it held back
03 AI
The fix gets written
- One prompt, ordered worst first
- Written for whichever tool built your app
- Carries its own limits: change these lines, keep every signature
All three passes happen inside one single-use Google Cloud Run job, created for your scan and destroyed when it ends.
What happens to your code #
Built to DPDP Act 2023 India's data-protection law, and the one we answer to. Consent you can withdraw, a breach clock, and a named officer on the hook. How we meet it #
Aligned with GDPR data rights Your access, correction and deletion rights, honoured wherever you live. We claim no certificate and no EU representative, only the substance. What aligned means #
Payments PCI DSS via Dodo Card entry is handled entirely by our payment processor, Dodo. Those details never reach, and are never stored on, a Sentrint server. Where money goes
Subprocessor directory
What it costs #
Top-up
Buy a pack, scan when you need to. No subscription and no renewal date.
6 scans in a pack.
- 6 deep scans, credits never expire
- Every finding, ranked by what to fix first
- Copy-paste fix prompt for 16 AI tools
- Per-finding AI fix & false-positive review
-
Score, grade and a badge for your repo
-
One-time purchase, not a subscription
Founder
For anyone shipping every week. Scan on every change instead of rationing them. Cancel any time, from Settings.
₹1,499.17$18.33 a month, billed once a year.
[Subscribe](https://sentrint.com/auth/github)
[Subscribe](https://sentrint.com/auth/github)
- 36 scans a month , everything in Top-up
- Top-up packs when you need more scans
- CSV & JSON export of findings
- Dependency inventory & CycloneDX SBOM
- MCP server
- REST API
Services
External exposure intelligence for people and organizations. Hands-on work, not automation or software. Every project is scoped on a call before a quote is provided.
₹4,000$50 a day, 3-day minimum.
Coming soon
- Digital Footprint Assessment
- Breach & Credential Exposure Assessment
Free plan One scan every calendar month, not every thirty days. Your GitHub account needs to be 30 days old to claim it. 1 scan per month
- Score, grade and badge
- Every finding, in full
- The fix prompt
- MCP server and REST API
Free scan ₹0$0