Roadmap

Published so you can plan around it. Anything not yet shipped may change.

Shipped

Scans: SAST, SCA, secrets, IaC (Terraform, Helm, Kubernetes, Dockerfile, CloudFormation, Bicep), container and DAST, with a shared finding model.

Imports: findings from Snyk, Semgrep, SonarQube, Checkmarx, Veracode, Trivy, Qualys, Tenable, Prisma Cloud and GitHub code scanning.

Triage: a deterministic remediate-or-defer decision on every finding, kept with its evidence.

Remediation plans and test plans: delivered to coding agents over MCP. The agent makes the change and runs the tests.

Compliance mappings: SOC 2, ISO 27001, PCI DSS, HIPAA, GDPR and DORA.

Interfaces: the web app, the sentrasec CLI and the MCP server.

Deployment: Sentrasec Cloud and self-hosted.

Knowledge graph: rules, CVEs, CWEs, OWASP categories, packages, remediations and relationships, with graph-derived explanations.

Integrations: GitHub, GitLab, Jira, Linear, Slack, Microsoft Teams, webhooks and email. Railway is live as a cloud connector.

In progress

Cloud connectors for AWS, Azure, GCP, Oracle and Alibaba. Built and tested against fixtures; not yet live against real accounts.

Expanded SAST language coverage. Adding rules and languages to static analysis.

Remediation plan depth. Better plans for changes that span several files and their tests.

Planned

Policy as code. Version-controlled policy definitions with review workflows, rather than console configuration.

Richer runtime evidence. Stronger signals for whether vulnerable code actually ships and runs.

Additional compliance frameworks. Beyond SOC 2, ISO 27001, PCI DSS, HIPAA, GDPR and DORA.

Restricted-network deployments. A documented path for self-hosted deployments with limited or no outbound access.

Under consideration

These are being evaluated. Interest from users is a genuine input:

• IDE extensions with inline findings outside the MCP path.
• Multi-repository dependency graph analysis across an organisation.
• Custom rule authoring with a local testing workflow.

Feedback

The deployment is open source: GitHub issues is the right place for defects and specific proposals. Discord works better for open-ended discussion about where this should go.