"status": "FAILED"

Inspiration

Inspiration Data breaches often start with a simple developer mistake: accidentally committing an API key or database password to a repository. While enterprise solutions exist, I wanted to build a lightweight, continuous integration tool that catches these vulnerabilities at the exact moment a developer opens a Pull Request, preventing bad code from ever merging.

What it does

SentinelPR acts as a middleman between developers and the codebase. It uses FastAPI to listen for GitHub webhook payloads whenever a new Pull Request is created or updated. It extracts the code changes and runs a static analysis engine using regular expressions to detect high-risk patterns like AWS Access Keys, generic API secrets, and hardcoded passwords. It then generates an automated security report indicating whether the PR is safe to review or needs immediate remediation.

How we built it

I built the backend engine using Python and FastAPI because of its speed and excellent handling of asynchronous webhook requests.

Routing & Server: Handled by Uvicorn.

Analysis Engine: Built a custom regex-based scanning module that maps code strings against known vulnerability signatures.

Data Handling: Used Pydantic to structure the incoming JSON payloads from mock GitHub webhooks.

Challenges we ran into Handling the deeply nested JSON payloads that webhooks send can be tricky. Extracting the exact lines of code or the PR body required careful parsing to ensure the scanner didn't crash on empty or misconfigured payloads. I also had to fine-tune the regular expressions to minimize false positives while ensuring real secrets were caught.

Accomplishments that we're proud of I am proud of building a functional DevSecOps tool from scratch. Getting the FastAPI server to successfully intercept a simulated webhook and return a parsed, accurate security JSON report in milliseconds was a major win. It proves that powerful security guardrails don't have to be overly complex.

What we learned

I deepened my understanding of how webhooks operate, how to build robust REST APIs in Python, and the fundamentals of static application security testing (SAST).

What's next for SentinelPR

Direct GitHub Integration: Connecting the GitHub REST API so the backend can automatically post the security report as a comment directly on the Pull Request.

Slack Alerts: Pushing high-severity vulnerability alerts to an engineering team's Slack channel.

Expanded Rule Engine: Adding more regex patterns to catch a wider variety of secrets, such as Stripe tokens or private RSA keys.