Skip to content

Sentinel

Sentinel is an AI security agent that finds vulnerabilities before attackers do.

Code Video Cerebral Valley

Core trick

Gemini reviews full file contents on each GitHub push for XSS, SQL injection, and IDOR, then opens a fix PR automatically.

Tags

securitydev tools

Description

Sentinel is an AI security agent that finds vulnerabilities before attackers do. It monitors code changes, detects exploitable security regressions, alerts teams in Slack, and automatically opens a PR with the issue, fix recommendation, and steps to reproduce.
hardikgoyal/cvhacks★ 00 forksTypeScriptCreated Mar 21, 2026 · last push Mar 21, 2026

README excerpt

# Sentinel — AI Security Agent for GitHub

> Push vulnerable code. Get a fix PR in seconds.

Sentinel is an autonomous security agent that watches every push to your repository, detects exploitable vulnerabilities using Gemini, and opens a pull request with a working fix — including step-by-step reproduction instructions.

---

## How It Works

```
git push
   │
   ▼
GitHub Webhook
   │
   ▼
Gemini analyzes full file contents
(XSS · SQL Injection · IDOR)
   │
   ├── NONE → silent ✓
   │
   └── Vulnerability found
          │
          ├── Creates fix branch
          ├── Commits patched code
          ├── Opens PR with repro steps
          ├── Posts commit comment
          └── Sends Slack alert
```

**Time from push to fix PR: ~15 seconds.**

---

## Demo

Push a commit that touches a file with an XSS vulnerability:

```js
// pages/search.js — dangerous: renders user input as HTML
<div dangerouslySetInnerHTML={{ __html: searchResult }} />
```

Sentinel opens a PR that looks like this:

---

### 🟠 Sentinel Security Fix — XSS (HIGH)

> The `query` parameter from the URL is interpolated into an HTML template string and then rendered directly via `dangerouslySetInnerHTML` without sanitization. An attacker can craft a URL like `/search?query=<img src=x onerror=alert('xss')>` to execute arbitrary JavaScript in any visitor's browser — enabling session hijacking, credential theft, or phishing redirects.

| Field | Value |
|-------|-------|
| **Type** | XSS |
| **Severity** | HIGH |

Team