Sentinel AI

The GitHub Copilot for Security Reviews. Sentinel AI scans repositories, detects real security issues deterministically, and uses AI to generate evidence-backed explanations, risks, and remediation.

Comment

Inspiration

Modern AI code review tools are impressive, but they often suffer from a major problem: hallucination. Security recommendations without concrete evidence can lead developers to waste time investigating issues that do not actually exist.

We wanted to build an AI security reviewer that developers could trust.

Instead of allowing an LLM to invent vulnerabilities, Sentinel AI follows an Evidence-First architecture. Every AI explanation is grounded in deterministic static analysis, ensuring that the AI only explains verified findings instead of generating speculative ones.

What it does

Sentinel AI analyzes public GitHub repositories using a deterministic static analysis engine before sending only verified evidence to an AI security reviewer.

The platform currently detects:

  • Broken Object Level Authorization (BOLA / IDOR)
  • Hardcoded Secrets
  • Dangerous CORS Configurations
  • Weak JWT Configurations
  • Missing Rate Limiting
  • Open Redirects
  • Path Traversal
  • Command Injection
  • Unsafe File Uploads

For every finding Sentinel AI provides:

  • Evidence-backed explanation
  • Risk score
  • Confidence score
  • CWE mapping
  • OWASP mapping
  • Secure remediation guidance
  • Human-review patch suggestions
  • Verification checklist

The AI never invents findings.

How we built it

The project consists of several components:

  • Python backend
  • FastAPI REST API
  • Deterministic static analysis engine
  • GitHub repository acquisition
  • Evidence packaging pipeline
  • GPT-powered security reviewer
  • React frontend dashboard
  • Docker deployment

The scanning pipeline follows this flow:

Repository

↓

Repository Discovery

↓

Deterministic Static Analysis

↓

Evidence Package

↓

AI Security Review

↓

Interactive Dashboard

Unlike many AI security assistants, Sentinel AI always keeps deterministic findings as the authoritative source while AI acts only as an explanation layer.

How we used Codex and GPT-5.6

OpenAI Codex significantly accelerated development throughout the project.

We used Codex to:

  • implement new deterministic detection rules
  • reduce false positives in secret detection
  • improve confidence scoring
  • refine repository scanning heuristics
  • generate and expand automated test cases
  • resolve static type checking issues
  • improve documentation
  • refactor scanning logic
  • validate changes through automated testing

GPT-5.6 was used as an engineering assistant to:

  • design the evidence-first architecture
  • review security rule logic
  • improve remediation guidance
  • refine the AI review workflow
  • improve project documentation
  • help prepare the presentation and README

Together, Codex and GPT-5.6 allowed us to iterate much faster while keeping every security rule deterministic and explainable.

Challenges we ran into

One of the biggest challenges was balancing detection accuracy with false positives.

For example, our initial hardcoded secret detector incorrectly flagged values such as:

const invalidPasswordErrorMessage = "Invalid password";

Although this contains the word "password", it is only user-facing text.

We designed deterministic suppression rules for descriptive UI labels while still detecting:

  • production passwords
  • JWT secrets
  • provider API tokens
  • private keys
  • high-entropy credentials

Another challenge was ensuring that weak credentials inside tests and fixtures did not incorrectly classify entire repositories as high risk, while still preserving detection of genuine exposed secrets.

Finally, due to OpenAI API budget limitations, the current prototype demonstrates the AI review architecture but cannot yet perform large-scale live GPT-powered reviews for every repository.

What we learned

Building Sentinel AI taught us that trustworthy AI security tooling depends on deterministic evidence rather than unrestricted language model reasoning.

We learned how to:

  • design explainable static analysis
  • build deterministic security rules
  • reduce false positives through bounded heuristics
  • integrate AI as an advisory layer rather than a decision maker
  • build an end-to-end repository security analysis pipeline

What's next

Sentinel AI is currently a working prototype.

Our roadmap includes:

  • SQL Injection detection
  • Cross-Site Scripting (XSS)
  • Server-Side Request Forgery (SSRF)
  • broader OWASP API Top 10 coverage
  • additional language support
  • incremental repository scanning
  • pull request security reviews
  • GitHub App integration
  • scalable AI security reviews using production OpenAI APIs

Built With

Share this project:

Updates