Sentrint · Ship your app, not your secrets
and the footer is left outside it, so a<br>screen reader gets one "skip to main content" target that lands on the<br>hero and a separate contentinfo landmark for the footer. Kept as a bare<br>wrapper (no styles of its own) — .page still owns the rail and padding. -->
Ship your app.<br>Not your secrets.
Point Sentrint at the repo behind the app you built with Claude, Gemini or any of the 14 LLM platforms it supports. Its security engine reads every line for four things: hardcoded secrets, database access rules, dependencies and code paths. An AI layer then drops the results that are not really exploitable and writes the fix. Back comes a score out of 100 with a grade, every finding written in plain English, and a fix prompt rewritten for whichever of those platforms built the app. Paste the fix, scan again, and the grade climbs.
You built it with<br>Claude<br>Gemini<br>14 LLM platforms
Scanning
Security engine
SecretsiAPI keys, tokens and passwords left sitting in your code, or still in your git history.
Access rulesiWhether your database and your admin pages are actually locked, or open to anyone with the link.
DependenciesiThe open-source packages you rely on, checked against known vulnerabilities.
Code pathsiPlaces where someone else's input becomes your command.
AI layer
Cuts false alarmsiAn AI reads every result the engine returns and drops the ones that are not really exploitable, so you are not chasing noise.
Writes the fixiThe fix is written out as a prompt for whichever platform built your app, ready to paste straight back into it.
You get back
The verdict
29 / 100
The findings<br>Every security flaw explained in plain English.
Your fix prompt<br>14 LLM platforms
Paste it, scan again, the grade climbs
Built with Bolt, v0 or Cursor? You can't read every line it wrote. We scan for what's actually leaking (an open database, a live key, an unlocked admin page) and hand you a fix prompt for the same tool that wrote the bug.
See a full report
Scan your repo free
Free · no card · code scans in ephemeral instance
29/100 on a real repo we scanned.<br>8 critical, 12 findings in all.
Every screenshot below is one real scan
A real scan of a real public repo, shown exactly as you would get it. The repo name, the paths and every key are starred out. Publishing a stranger's live credentials is not ours to do. Your own report names every file and every line.
A grade, the flaws, the fix.<br>And proof you fixed it.
01
The ledger. Every repo you own, as one number.
One score across everything you have scanned, what is still open, and what moved since last time. The point of scanning twice is the second number.
Fixed versus new, every scan. The tile that tells you whether the work worked.
A score with a trend , not a snapshot you have to remember to compare.
Findings split by type , so leaked secrets and an old lockfile stop competing for the same attention.
Only the repos you pointed us at. Nothing else appears here.
Security ledger · every repo, one score
02
The verdict. One number, and what it is made of.
A grade out of 100, split into the code you wrote and the packages you pulled in. No wall of CVE identifiers to triage before you know whether anything is actually wrong.
Severity you can act on , counted separately, worst first.
Code and dependencies graded apart , because a bad lockfile and a leaked key are not the same problem.
The arithmetic is shown , so the score is checkable rather than asserted.
Report header · real scan, identity redacted
03
The findings. In English, not in CVE numbers.
What it is, where it lives, and what happens if somebody finds it first.
Databases anyone can read , the usual way these apps leak.
Leaked keys that still work. We test them, so you know which to rotate first.
Pages with no lock , admin and billing, reachable by guessing.
Code that trusts strangers , where a form field runs as code.
Secrets in old commits. Deleting the file did not delete the key.
Outdated packages with known holes already published in them.
Server keys in the browser , shipped in what every visitor downloads.
Doors left wide open , CORS and API settings that let any site call yours.
Each one is read a second time by an AI that says whether it is really exploitable, and why. When it downgrades one, it tells you what it decided and leaves the finding on the page.
Every one of these, explained
Findings, critical group open
04
The fix. A prompt, not a to-do list.
Not a checklist to work through by hand. One prompt, ordered worst first, ready to paste back into whichever platform built the app.
Rewritten per platform , for Claude, Cursor, Lovable, ChatGPT, Gemini and 14 in all.
Says what an AI cannot do for you , because rotating a leaked key is your job, not the model's.
Ordered by what is exploitable now , not by what is easiest to patch.
Counts the leaked keys separately , because rotating one is a job no...