Sentrint

Sentrint is a security scanning tool aimed at developers who build apps with AI coding assistants like Claude, Cursor, Lovable, or Gemini. Currently in Beta v0.9, it points at a GitHub repository, runs a multi-pass security engine, and returns a score out of 100 with a letter grade, ranked findings in plain English, and a copy-paste fix prompt formatted for whichever AI platform built the app.

What It Is

Sentrint is a code security scanner purpose-built for the "vibe coding" era—apps generated quickly with AI assistants that often ship with exploitable vulnerabilities. The tool reads every line of a repository for four categories of risk: hardcoded secrets (API keys, tokens, passwords), database and admin access rules, open-source dependency vulnerabilities, and dangerous code paths where user input can become a command. An AI layer then filters out non-exploitable findings and writes a structured fix prompt ordered by severity.

How the Three-Pass Architecture Works

Sentrint's scan runs in three sequential passes inside a single-use Google Cloud Run container:

• Pass 1 (No AI): A deterministic rules engine checks code and lockfiles. A rule either matches or it doesn't—nothing here can be argued into a finding.
• Pass 2 (AI review): Every critical and high finding is re-read by an AI model. It cannot invent findings, only remove ones that aren't truly exploitable, and it reports how many it held back.
• Pass 3 (AI fix writing): A fix prompt is generated, ordered worst-first, phrased for the specific AI platform that built the app, and constrained to change only the flagged lines.

The container is created for one scan and destroyed when it exits. Code is deleted with the container; only a ~10-line excerpt around critical/high findings is retained for up to 30 days to allow fix prompt reconstruction.

What You Get Back

Each scan produces:

• A score out of 100 and a letter grade (A through C; below C the badge reads "unrated" rather than showing a D or F)
• Findings grouped by severity (critical, high, medium, low), each explained in one plain-English line with file and line number
• Leaked credentials tested live against their issuing provider so you know which keys to rotate first
• A fix prompt panel with a tab per supported AI platform (16 total, including Cursor, Windsurf, GitHub Copilot, Cline, Replit, Claude Code, Lovable, Bolt, v0, Base44, DeepSeek, Claude, ChatGPT, and Gemini)
• A README badge that reads the live grade at load time and stops displaying below a C

The dashboard tracks all scanned repos with a portfolio score, a per-repo trend chart, and a "fixed vs. new" tile that shows whether remediation work actually moved the needle.

Target Audience and Why It Matters

Sentrint is explicitly aimed at non-technical founders, indie developers, and anyone shipping AI-generated code without a security background. The homepage cites third-party research to frame the problem: Symbiotic Security reportedly found that 98% of 1,072 vibe-coded apps carried at least one security flaw; SupaExplorer reportedly found that 11% of indie apps ship database keys in the browser; and Wiz Research documented 1.5 million API tokens exposed by a single weekend-built AI app. Sentrint positions itself as the bridge between AI-assisted development speed and production-safe security posture.

Privacy and Compliance Model

Sentrint states it is built to India's DPDP Act 2023 and aligned with GDPR data rights. Key commitments include read-only GitHub App access scoped to a single chosen repository, no write permissions, no cross-scan data sharing, no model training on user code, and a named Grievance Officer (Gourab Dasgupta). Payments are handled entirely by Dodo Payments as merchant of record; card details never reach Sentrint servers. The subprocessor stack includes Cloudflare, GitHub, Upstash, Google Cloud, OpenRouter, Anthropic (zero-retention endpoints), Supabase, Dodo Payments, Sentry, and PostHog.

Current Status: Beta v0.9

Sentrint is live and publicly accessible at Beta v0.9, running on Google Cloud under the Google for Startups Cloud Program. A free tier requires no credit card and no account for the initial scan. The GitHub organization (github.com/Sentrint/welcome) was created in August 2026 and is used for community discussions rather than as the product's source repository. The product is listed on Product Hunt, LaunchPact, and Startup Fame.