SentinelSentinel.

Infrastructure configuration scanner

Check your config.Know what to fix.

Sentinel scans Docker, Kubernetes and Terraform files for configuration risks. See what needs attention, why it matters and how to fix it.

Start with a free account. No repository connection needed.

Just exploring? The example needs no account.

Watch a configuration change take shape01 / KUBERNETES
Configuration reviewAnimated example
Kubernetes / Deployment1 critical · 2 high

Less privilege. Three precise changes.

A real deployment with replicas, resource limits and health checks.

  1. Privileged mode
  2. Escalation
  3. Capabilities
k8s/deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata: {name: api, namespace: apps}
spec:
  replicas: 2
  selector: {matchLabels: {app: api}}
  template:
    metadata: {labels: {app: api}}
    spec:
      automountServiceAccountToken: false
      securityContext: {seccompProfile: {type: RuntimeDefault}}
      containers:
        - name: api
          image: docker.io/hashicorp/http-echo:1.0.0
          args: ["-listen=:8080", "-text=ok"]
          ports: [{containerPort: 8080}]
          resources: {requests: {cpu: 100m, memory: 64Mi}, limits: {cpu: 200m, memory: 128Mi}}
          startupProbe: {tcpSocket: {port: 8080}, failureThreshold: 30}
          livenessProbe: {tcpSocket: {port: 8080}, timeoutSeconds: 2}
          readinessProbe: {tcpSocket: {port: 8080}, timeoutSeconds: 2}
          securityContext:
            runAsNonRoot: true
            runAsUser: 10001
            readOnlyRootFilesystem: true
            privileged: false
            allowPrivilegeEscalation: false
            capabilities: {drop: [ALL]}
YAML · Deployment/api
Checked with Sentinel’s rule engine.

These three fixes pass re-scan. Other findings still need review. Test changes before applying.

3 proposed changes · ready to review
Built for your stack
  • Docker
  • Compose
  • Kubernetes
  • Helm
  • Terraform
  • Nginx
  • Ansible

01 The workflow

A finding is the start.
A decision is the outcome.

Move from a flagged line to a change your team can review. Every step stays connected to the configuration that caused it.

  1. Start with a file

    Upload configuration files or scan a connected repository. No running environment needed.

    Your configuration

  2. Understand the risk

    See the severity, source location and recommendation. Add an AI explanation when you need one.

    Prioritised findings

  3. Review a real change

    Inspect supported fix diffs and prepare a pull request. Your team decides what to test and merge.

    Reviewable fixes

  4. Verify the result

    Scan the updated code. Compare findings with a saved baseline and record your decisions.

    A traceable review
Read the workflow guides

02 Built for client work

Give your client
the complete picture.

Turn configuration findings into a clear engineering review: what needs work, what you decided and what changed.

A workspace for each project

Keep repositories, members and review context together.

Decisions with a record

Capture engineering decisions and compare with a saved baseline.

Share with the right people

Give named recipients access to a report, or export a copy.

Explore the agency workflow

Example client review

API infrastructure

A clear record of what needs attention and what happens next.

  • Non-root container user

    Fix proposed

    Inspect the proposed change before applying it.

  • Resource limits

    Needs review

    Record the engineering decision and its reason.

  • Baseline comparison

    Available after rescan

    Compare new evidence with the saved baseline.

Share with named recipients

Report access is granted to specific accounts.

Findings · decisions · proposed changes
Illustrative review layout. No live scan or client data.

03 Control stays with you

Your code.
Your call.

Security & data handling
Deterministic checks
Rules produce the findings. The core scan works without an LLM.
AI when you choose it
Optional explanations help you interpret a finding. Check data handling before enabling AI for client code.
You approve every change
Supported fixes are proposals. Review and test them against your application before merging.

Start small. Add room as you grow.

Your next review starts here.

Compare repository, scan and AI allowances. Pick what your team needs.

Compare plans

Before your first scan

Good questions.
Straight answers.

Do I need to connect a repository first?

No. Explore the example results without an account. For your own scan, create an account or sign in, then choose configuration files. Connecting a repository is optional.

Does the rule engine depend on AI?

No. Deterministic rules produce the findings. AI explanations are optional and subject to the limits of your plan.

Will Sentinel change production?

The workflow reviews infrastructure code. Supported fixes are proposals to inspect, test, and merge yourself. A scan cannot guarantee a secure or reliable deployment.

Can I use it across client projects?

Yes. Organize repositories in workspaces, record engineering decisions in client reviews, and share reports with named recipients. Agree on access with each client before connecting their code.

Ready when you are

Start with the code
you already have.

Create an account first, then choose files from your device. You can connect a repository after signing in.

An account for your own scans

After signing in, choose a Dockerfile, Kubernetes YAML, Terraform or other supported configuration file.

Want to look around first? Open the example results above.