Native scanners
Sentrasec scans source, dependencies, infrastructure definitions, containers and running applications, imports findings from your existing tools, and reports it all as one deduplicated, triaged finding set.
Sentrasec scans and imported findings land in the same model, on one severity scale, deduplicated. You stop reconciling outputs from tools with their own formats and their own idea of a duplicate.
Import findings from Snyk, Semgrep, SonarQube, Checkmarx, Veracode, Trivy, Qualys, Tenable, Prisma Cloud and GitHub code scanning. They are triaged the same way as Sentrasec’s own.
Each finding is marked remediate or defer based on evidence from your project: is the endpoint reachable, does attacker-controlled input reach it, does the code ship to runtime, is there a compensating control.
Rules carry the CWE they map to, the OWASP category above it, and the remediation known to resolve it. That is what lets a finding explain itself.
Every scan type listed here ships today. Nothing on this page is a roadmap item.
Static analysis of your source code.
Source is checked against versioned detection rules. Each finding names the file, the line and the rule that matched, and goes through triage before it reaches you.
Pattern and entropy detection for credentials committed to source control.
Covers common cloud and SaaS credential formats, with entropy checks for keys that do not match a known shape.
Dependency analysis against known vulnerability data.
Your resolved dependency tree is checked, including transitive packages. Triage then asks whether the vulnerable code actually ships to runtime.
Infrastructure definitions checked before they are deployed.
Covers Terraform, Helm charts, Kubernetes manifests, Dockerfiles, CloudFormation and Bicep, so misconfiguration is caught at review time rather than in production.
Image analysis and build hygiene.
Images are checked for vulnerable operating-system and language packages, and for problems in the build itself such as running as root or unpinned base images.
Active testing against a running application.
The running target is crawled, its endpoints exercised, and what actually responded is reported. Findings are deduplicated and triaged like every other finding.
We will run a scan against one of your projects and walk through the triage and remediation plans.
