Check your code and your site before you ship.
SentinelOSS scans every push for vulnerable dependencies, risky CI workflows and licence problems, and checks your live site for secrets it hands to every visitor.
How it works — every push
Results delivered in under 15 seconds per push
Hover any step above to see what happens there.
Five security checks on every push
No configuration needed — all five run automatically from the moment you connect your repo.
Dependency CVEs
OSV + NVDEvery package in your lockfile checked against the OSV database and GitHub Advisory DB. Finds known vulnerabilities with severity ratings.
SSL / TLS Grade
Qualys SSL Labs analysis — protocol versions, cipher suites, HSTS, certificate validity. Graded A+ to F with specific improvement steps.
Supply Chain
Scans your GitHub Actions workflows for 16 attack patterns: curl-to-shell, unpinned actions, pull_request_target, sudo, self-hosted runners.
Security Headers
Checks HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and Permissions-Policy. Scored A+ to F with per-header fix tips.
License Compliance
Detects GPL, AGPL, LGPL, MPL, and other copyleft licenses in your npm dependencies. Flags packages that may affect your distribution rights.
Up and running in 3 minutes
No agents to install. No CI changes needed. Just a GitHub webhook.
Create your account
Sign in with GitHub — your organisation is created automatically.
Generate your webhook secret
One click on the Automation page gives you a unique Webhook URL and secret.
Add to GitHub
Paste the URL and secret into your repo's Webhook settings. That's it.
You receive in Slack
📦 SentinelOSS Security Report
Repo: your-org/api-service
Branch: main · Commit: a3f9c12
Pusher: rafraf · Packages: 248
🚨 CVEs — Critical: 0 | High: 2 | Medium: 5
🔒 SSL sentineloss.cloudrf.xyz: A+
🔗 Supply chain: CLEAN
View full report →
Delivered in ~12 seconds after push
Alerts where your team already works
Add as many channels as you need — all fire simultaneously on every push.
Slack
Paste an Incoming Webhook URL
Microsoft Teams
Paste an Incoming Webhook URL
Telegram
Enter bot token + chat ID
Also available: on-demand scanners
Run one-off scans — no account required. CVEs, licenses, headers, SSL, supply chain and more.