SentinelFlow

Autonomous SOC platform that monitors GitLab merge requests, scans for vulnerabilities, assigns CVEs, auto-applies fixes, and posts security reports.

Comment

Inspiration

What it does

How we built it

Challenges we ran into

Accomplishments that we're proud of

What we learned

What's next for SentinelFlow

🛡️ SentinelFlow — Autonomous Security Operations Center for GitLab

SentinelFlow is a multi-agent security platform that runs inside your GitLab projects. When a developer opens or updates a merge request, SentinelFlow automatically:

  1. Classifies the event — determines if the change is worth scanning (not noise like docs or test files)
  2. Scans for vulnerabilities — runs nuclei, ffuf, and subfinder in parallel against code diffs, URLs, and domains
  3. Assigns CVE records — scores severity with CVSS v3.1, infers CWE category, deduplicates findings
  4. Applies fixes — generates parameterized query fixes or creates a dedicated GitLab branch with a patch
  5. Notifies — posts a formatted security report directly on the MR (also Slack, Discord, email)

🔬 The Pipeline

GitLab MR/push → Monitor → Scanner → CVE → Fix → Notify → MR Comment

Five function-based agents communicate via typed dict payloads through a single SentinelFlow orchestrator. No message queue. No separate services. Just Python.

✨ Key Features

Feature Details
🔍 Auto-scan Triggered by MR opened/updated or push events
⚡ Parallel scanners nuclei, ffuf, subfinder run concurrently
🏷️ CVE assignment CVSS v3.1 scoring with SF-{YEAR}-{N} IDs
🔧 Auto-fix Creates real GitLab branch + commit + MR for eligible CVEs
💬 MR comments Detailed markdown security reports posted to your MR
📊 Dashboard FastAPI UI for scan history
🔔 Multi-channel GitLab MR comment, Slack, Discord, Email

🏗️ Architecture

  • Monitor Agent — GitLab webhook receiver, event classification, target extraction (<500ms response)
  • Scanner Agent — spawns nuclei/ffuf/subfinder in parallel, parses results
  • CVE Agent — CVSS v3.1 scoring, CWE inference, deduplication, immutable JSON records
  • Fix Agent — generates fix templates, creates GitLab branches + commits + MRs via API
  • Notify Agent — formats security reports, fires GitLab comments, Slack, Discord, email in parallel

All agents communicate via typed dicts. Swarm mode scales to 100+ concurrent agents for batch scanning.

🧪 Demo

A 143-second narrated demo video is included with this submission showing:

  • Real GitLab webhook trigger (<500ms response)
  • Parallel scanner execution (nuclei + ffuf + subfinder)
  • CVE assignment (CRITICAL 9.8 CVSS)
  • Real GitLab branch + MR creation via API
  • Security report posted directly on the merge request

🛠️ Tech Stack

  • Language: Python 3
  • Dashboard: FastAPI + vanilla JavaScript
  • Scanners: nuclei, ffuf, subfinder (industry-standard security tools)
  • API: GitLab REST API v4
  • CORS: Local Python proxy for GitLab API access
  • Multi-agent: sessions_spawn (up to 100 concurrent agents via Swarm mode)

📁 Repository

Primary: GitLab (access pending — submitted March 21, 2026)

Fallback/Development: http://localhost:3000/alfie/sentinel-flow (Gitea)

👤 Built By

Alvin Chang — Good CISO Limited

  • goodciso.org
  • GitLab AI Hackathon Participant

Built With

  • fastapi
  • ffuf
  • gitlab-rest-api-v4
  • nuclei
  • python
  • subfinder
  • vanilla-javascript
Share this project:

Updates